Commit 81119857 authored by LuK1337's avatar LuK1337
Browse files

sm8150-common: Add seccomp policy

parent 798a1775
# Copyright (c) 2020 Qualcomm Technologies, Inc.
# All Rights Reserved.
# Confidential and Proprietary - Qualcomm Technologies, Inc
#
# Not a contribution.
#
# Copyright (C) 2018 The Android Open Source Project
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
mmap: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE
munmap: 1
getuid: 1
writev: 1
prctl: arg0 == PR_SET_VMA || arg0 == PR_GET_DUMPABLE
mprotect: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE
openat: 1
futex: 1
close: 1
read: 1
newfstatat: 1
fstat: 1
#ioctl: arg1 == BINDER_WRITE_READ || arg1 == BINDER_SET_MAX_THREADS || arg1 == BINDER_VERSION
ioctl: 1
mremap: 1
readlinkat: 1
pread64: 1
fstatfs: 1
rt_sigprocmask: 1
faccessat: 1
sendto: 1
rt_sigaction: 1
socket: arg0 == AF_UNIX || arg0 == AF_QIPCRTR
recvfrom: 1
getsockname: 1
getdents64: 1
fcntl: 1
nanosleep: 1
getrandom: 1
clone: 1
pipe2: 1
exit_group: 1
write: 1
exit: 1
getpid: 1
sigaltstack: 1
getrlimit: 1
restart_syscall: 1
setsockopt: 1
sched_getscheduler: 1
rt_sigreturn: 1
execve: 1
madvise: 1
set_tid_address: 1
connect: 1
ppoll: 1
clock_gettime: 1
# Copyright (C) 2018 The Android Open Source Project
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# Organized by frequency of systemcall - in descending order for
# best performance.
futex: 1
ioctl: 1
write: 1
prctl: 1
clock_gettime: 1
getpriority: 1
read: 1
close: 1
writev: 1
dup: 1
ppoll: 1
mmap2: 1
getrandom: 1
# mremap: Ensure |flags| are (MREMAP_MAYMOVE | MREMAP_FIXED) TODO: Once minijail
# parser support for '<' is in this needs to be modified to also prevent
# |old_address| and |new_address| from touching the exception vector page, which
# on ARM is statically loaded at 0xffff 0000. See
# http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0211h/Babfeega.html
# for more details.
#mremap: arg3 == 3
mremap: arg3 == 3 || arg3 == MREMAP_MAYMOVE
munmap: 1
mprotect: 1
madvise: 1
openat: 1
sigaltstack: 1
clone: 1
setpriority: 1
getuid32: 1
fstat64: 1
fstatfs64: 1
pread64: 1
faccessat: 1
readlinkat: 1
exit: 1
rt_sigprocmask: 1
set_tid_address: 1
restart_syscall: 1
exit_group: 1
rt_sigreturn: 1
pipe2: 1
gettimeofday: 1
sched_yield: 1
nanosleep: 1
lseek: 1
_llseek: 1
sched_get_priority_max: 1
sched_get_priority_min: 1
statfs64: 1
sched_setscheduler: 1
fstatat64: 1
ugetrlimit: 1
getdents64: 1
getrandom: 1
@include /system/etc/seccomp_policy/crash_dump.arm.policy
# device specific syscalls
pselect6: 1
eventfd2: 1
sendto: 1
recvfrom: 1
_llseek: 1
sysinfo: 1
getcwd: 1
getdents64: 1
#Copyright (c) 2020 Qualcomm Technologies, Inc.
#All Rights Reserved.
#Confidential and Proprietary - Qualcomm Technologies, Inc
#Not a contribution.
#Copyright (C) 2018 The Android Open Source Project
#"Licensed under the Apache License, Version 2.0 (the \"License\");"
#you may not use this file except in compliance with the License.
#You may obtain a copy of the License at
#http://www.apache.org/licenses/LICENSE-2.0
#Unless required by applicable law or agreed to in writing, software
#"distributed under the License is distributed on an \"AS IS\" BASIS,"
#WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#See the License for the specific language governing permissions and
#limitations under the License.
mmap: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE
munmap: 1
mprotect: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE
#prctl: arg0 == PR_SET_VMA || arg0 == PR_SET_NO_NEW_PRIVS || arg0 == PR_GET_DUMPABLE || arg0 == PR_SET_SECCOMP || arg0 == 0x37 /* PR_??? */
prctl: 1
read: 1
openat: 1
close: 1
shutdown: 1
kill: 1
futex: 1
fstat: 1
gettimeofday: 1
readlinkat: 1
newfstatat: 1
mremap: 1
pread64: 1
fstatfs: 1
rt_sigaction: 1
faccessat: 1
socket: arg0 == AF_UNIX || arg0 == AF_QIPCRTR
writev: 1
connect: 1
rt_sigprocmask: 1
fcntl: 1
sendto: 1
getrandom: 1
lseek: 1
exit_group: 1
rt_tgsigqueueinfo: 1
write: 1
exit: 1
getpid: 1
sigaltstack: 1
recvmsg: 1
dup: 1
getrlimit: 1
restart_syscall: 1
clone: 1
gettid: 1
sched_getscheduler: 1
ioctl: 1
execve: 1
getuid: 1
madvise: 1
set_tid_address: 1
nanosleep: 1
rt_sigreturn: 1
rt_sigsuspend: 1
setpriority: 1
geteuid: 1
getgid: 1
getegid: 1
getgroups: 1
pipe2: 1
setitimer: 1
pselect6: 1
getsockname: 1
recvfrom: 1
ppoll: 1
socketpair: 1
setsockopt: 1
getsockopt: 1
sendmsg: 1
bind: 1
timer_create: 1
timer_settime: 1
timer_delete: 1
clock_gettime: 1
sched_getaffinity: 1
#crash dump policy addition
socket: 1
process_vm_readv: 1
tgkill: 1
# Copyright (c) 2020 Qualcomm Technologies, Inc.
# All Rights Reserved.
# Confidential and Proprietary - Qualcomm Technologies, Inc
#
# Not a contribution.
#
# Copyright (C) 2018 The Android Open Source Project
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
mmap: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE
munmap: 1
mprotect: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE
#prctl: arg0 == 0x37 /* PR_??? */ || arg0 == PR_SET_VMA || arg0 == PR_GET_DUMPABLE || arg0 == PR_SET_SECCOMP || arg0 == PR_CAP_AMBIENT || arg0 == PR_GET_NO_NEW_PRIVS || arg0 == PR_SET_DUMPABLE || arg0 == PR_GET_NAME || arg0 == PR_SET_PTRACER
prctl: 1
openat: 1
read: 1
futex: 1
close: 1
fstat: 1
readlinkat: 1
newfstatat: 1
mremap: 1
fstatfs: 1
pread64: 1
rt_sigprocmask: 1
rt_sigaction: 1
faccessat: 1
#ioctl: arg1 == _IOC(_IOC_NONE
ioctl: 1
clock_gettime: 1
getrandom: 1
nanosleep: 1
fcntl: 1
getuid: 1
sigaltstack: 1
socket: arg0 == AF_QIPCRTR || arg0 == AF_UNIX
writev: 1
execve: 1
getpid: 1
set_tid_address: 1
sched_getscheduler: 1
sigaltstack: 1
sched_getaffinity: 1
connect: 1
pipe2: 1
clone: 1
ppoll: 1
restart_syscall: 1
exit: 1
exit_group: 1
rt_sigreturn: 1
rt_tgsigqueueinfo: 1
getppid: 1
dup: 1
capget: 1
capset: 1
setsid: 1
setitimer: 1
ptrace: 1
recvmsg: 1
exit: 1
restart_syscall: 1
gettid: 1
write: 1
dup3: 1
getdents64: 1
getsockname: 1
recvfrom: 1
madvise: 1
# Copyright (c) 2020 Qualcomm Technologies, Inc.
# All Rights Reserved.
# Confidential and Proprietary - Qualcomm Technologies, Inc
#
# Not a contribution.
#
# Copyright (C) 2018 The Android Open Source Project
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
mmap: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE
munmap: 1
#prctl: arg0 == PR_SET_VMA || arg0 == PR_GET_DUMPABLE || arg0 == 0x37
mprotect: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE
futex: 1
read: 1
openat: 1
close: 1
fstat: 1
readlinkat: 1
newfstatat: 1
mremap: 1
clock_gettime: 1
pread64: 1
fstatfs: 1
rt_sigaction: 1
faccessat: 1
rt_sigprocmask: 1
#ioctl: arg1 == TCGETS || arg1 == BINDER_WRITE_READ || arg1 == BINDER_SET_MAX_THREADS || arg1 == BINDER_VERSION
ioctl: 1
getrandom: 1
fcntl: 1
getuid: 1
lseek: 1
exit_group: 1
sched_getaffinity: 1
writev: 1
exit: 1
getpid: 1
sigaltstack: 1
getrlimit: 1
restart_syscall: 1
clone: 1
sched_getscheduler: 1
execve: 1
socket: arg0 == AF_UNIX
set_tid_address: 1
rt_sigreturn: 1
connect: 1
gettid: 1
setpriority: 1
prctl: 1
write: 1
......@@ -317,6 +317,12 @@ PRODUCT_COPY_FILES += \
vendor/oneplus/sm8150-common/proprietary/vendor/etc/qdcm_calib_data_samsung_s6e3fc2x01_cmd_mode_dsi_panel.xml:$(TARGET_COPY_OUT_VENDOR)/etc/qdcm_calib_data_samsung_s6e3fc2x01_cmd_mode_dsi_panel.xml \
vendor/oneplus/sm8150-common/proprietary/vendor/etc/qdcm_calib_data_samsung_sofef03f_m_fhd_cmd_mode_dsc_dsi_panel.xml:$(TARGET_COPY_OUT_VENDOR)/etc/qdcm_calib_data_samsung_sofef03f_m_fhd_cmd_mode_dsc_dsi_panel.xml \
vendor/oneplus/sm8150-common/proprietary/vendor/etc/sec_config:$(TARGET_COPY_OUT_VENDOR)/etc/sec_config \
vendor/oneplus/sm8150-common/proprietary/vendor/etc/seccomp_policy/atfwd@2.0.policy:$(TARGET_COPY_OUT_VENDOR)/etc/seccomp_policy/atfwd@2.0.policy \
vendor/oneplus/sm8150-common/proprietary/vendor/etc/seccomp_policy/codec2.vendor.base.policy:$(TARGET_COPY_OUT_VENDOR)/etc/seccomp_policy/codec2.vendor.base.policy \
vendor/oneplus/sm8150-common/proprietary/vendor/etc/seccomp_policy/codec2.vendor.ext.policy:$(TARGET_COPY_OUT_VENDOR)/etc/seccomp_policy/codec2.vendor.ext.policy \
vendor/oneplus/sm8150-common/proprietary/vendor/etc/seccomp_policy/imsrtp.policy:$(TARGET_COPY_OUT_VENDOR)/etc/seccomp_policy/imsrtp.policy \
vendor/oneplus/sm8150-common/proprietary/vendor/etc/seccomp_policy/qti-systemd.policy:$(TARGET_COPY_OUT_VENDOR)/etc/seccomp_policy/qti-systemd.policy \
vendor/oneplus/sm8150-common/proprietary/vendor/etc/seccomp_policy/vendor.qti.hardware.dsp.policy:$(TARGET_COPY_OUT_VENDOR)/etc/seccomp_policy/vendor.qti.hardware.dsp.policy \
vendor/oneplus/sm8150-common/proprietary/vendor/etc/seccomp_policy/wfdhdcphalservice.policy:$(TARGET_COPY_OUT_VENDOR)/etc/seccomp_policy/wfdhdcphalservice.policy \
vendor/oneplus/sm8150-common/proprietary/vendor/etc/seccomp_policy/wfdvndservice.policy:$(TARGET_COPY_OUT_VENDOR)/etc/seccomp_policy/wfdvndservice.policy \
vendor/oneplus/sm8150-common/proprietary/vendor/etc/seccomp_policy/wifidisplayhalservice.policy:$(TARGET_COPY_OUT_VENDOR)/etc/seccomp_policy/wifidisplayhalservice.policy \
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment