mkseccomp.sample

/* This sample file is an example for mkseccomp.pl to produce a seccomp file
 * which restricts syscalls that are only useful for an admin but allows the
 * vast majority of normal userspace programs to run normally.
 *
 * The format of this file is one line per syscall.  This is then processed
 * and passed to 'cpp' to convert the names to numbers using whatever is
 * correct for your platform.  As such C-style comments are permitted.  Note
 * this also means that C preprocessor macros are also allowed.  So it is
 * possible to create groups surrounded by #ifdef/#endif and control their
 * inclusion via #define (not #include).
 *
 * Syscalls that don't exist on your architecture are silently filtered out.
 * Syscalls marked with (*) are required for a container to spawn a bash
 * shell successfully (not necessarily full featured).  Listing the same
 * syscall multiple times is no problem.
 *
 * If you want to make a list specifically for one application the easiest
 * way is to run the application under strace, like so:
 *
 * $ strace -f -q -c -o strace.out application args...
 *
 * Once you have a reasonable sample of the execution of the program, exit
 * it.  The file strace.out will have a summary of the syscalls used.  Copy
 * that list into this file, comment out everything else except the starred
 * syscalls (which you need for the container to start) and you're done.
 *
 * To get the list of syscalls from the strace output this works well for
 * me
 *
 * $ cut -c52 < strace.out
 *
 * This sample list was compiled as a combination of all the syscalls
 * available on i386 and amd64 on Ubuntu Precise, as such it may not contain
 * everything and not everything may be relevent for your system.  This
 * shouldn't be a problem.
 */

// Filesystem/File descriptor related
access                 // (*)
chdir                  // (*)
chmod
chown
chown32
close                  // (*)
creat
dup                    // (*)
dup2                   // (*)
dup3
epoll_create
epoll_create1
epoll_ctl
epoll_ctl_old
epoll_pwait
epoll_wait
epoll_wait_old
eventfd
eventfd2
faccessat              // (*)
fadvise64
fadvise64_64
fallocate
fanotify_init
fanotify_mark
ioctl                  // (*)
fchdir
fchmod
fchmodat
fchown
fchown32
fchownat
fcntl                  // (*)
fcntl64
fdatasync
fgetxattr
flistxattr
flock
fremovexattr
fsetxattr
fstat                  // (*)
fstat64
fstatat64
fstatfs
fstatfs64
fsync
ftruncate
ftruncate64
getcwd                 // (*)
getdents               // (*)
getdents64
getxattr
inotify_add_watch
inotify_init
inotify_init1
inotify_rm_watch
io_cancel
io_destroy
io_getevents
io_setup
io_submit
lchown
lchown32
lgetxattr
link
linkat
listxattr
llistxattr
llseek
_llseek
lremovexattr
lseek                  // (*)
lsetxattr
lstat
lstat64
mkdir
mkdirat
mknod
mknodat
newfstatat
_newselect
oldfstat
oldlstat
oldolduname
oldstat
olduname
oldwait4
open                   // (*)
openat                 // (*)
pipe                   // (*)
pipe2
poll
ppoll
pread64
preadv
futimesat
pselect6
pwrite64
pwritev
read                   // (*)
readahead
readdir
readlink
readlinkat
readv
removexattr
rename
renameat
rmdir
select
sendfile
sendfile64
setxattr
splice
stat                   // (*)
stat64
statfs                 // (*)
statfs64
symlink
symlinkat
sync
sync_file_range
sync_file_range2
syncfs
tee
truncate
truncate64
umask
unlink
unlinkat
ustat
utime
utimensat
utimes
write                  // (*)
writev

// Network related
accept
accept4
bind                   // (*)
connect                // (*)
getpeername
getsockname            // (*)
getsockopt
listen
recv
recvfrom               // (*)
recvmmsg
recvmsg
send
sendmmsg
sendmsg
sendto                 // (*)
setsockopt
shutdown
socket                 // (*)
socketcall
socketpair
sethostname            // (*)

// Signal related
pause
rt_sigaction           // (*)
rt_sigpending
rt_sigprocmask         // (*)
rt_sigqueueinfo
rt_sigreturn           // (*)
rt_sigsuspend
rt_sigtimedwait
rt_tgsigqueueinfo
sigaction
sigaltstack            // (*)
signal
signalfd
signalfd4
sigpending
sigprocmask
sigreturn
sigsuspend

// Other needed POSIX
alarm
brk                    // (*)
clock_adjtime
clock_getres
clock_gettime
clock_nanosleep
//clock_settime
gettimeofday
nanosleep
nice
sysinfo
syslog
time
timer_create
timer_delete
timerfd_create
timerfd_gettime
timerfd_settime
timer_getoverrun
timer_gettime
timer_settime
times
uname                  // (*)

// Memory control
madvise
mbind
mincore
mlock
mlockall
mmap                   // (*)
mmap2
mprotect               // (*)
mremap
msync
munlock
munlockall
munmap                 // (*)
remap_file_pages
set_mempolicy
vmsplice

// Process control
capget
capset                 // (*)
clone                  // (*)
execve                 // (*)
exit                   // (*)
exit_group             // (*)
fork
getcpu
getpgid
getpgrp                // (*)
getpid                 // (*)
getppid                // (*)
getpriority
getresgid
getresgid32
getresuid
getresuid32
getrlimit              // (*)
getrusage
getsid
getuid                 // (*)
getuid32
getegid                // (*)
getegid32
geteuid                // (*)
geteuid32
getgid                 // (*)
getgid32
getgroups
getgroups32
getitimer
get_mempolicy
kill
//personality
prctl
prlimit64
sched_getaffinity
sched_getparam
sched_get_priority_max
sched_get_priority_min
sched_getscheduler
sched_rr_get_interval
//sched_setaffinity
//sched_setparam
//sched_setscheduler
sched_yield
setfsgid
setfsgid32
setfsuid
setfsuid32
setgid
setgid32
setgroups
setgroups32
setitimer
setpgid                // (*)
setpriority
setregid
setregid32
setresgid
setresgid32
setresuid
setresuid32
setreuid
setreuid32
setrlimit
setsid
setuid
setuid32
ugetrlimit
vfork
wait4                  // (*)
waitid
waitpid

// IPC
ipc
mq_getsetattr
mq_notify
mq_open
mq_timedreceive
mq_timedsend
mq_unlink
msgctl
msgget
msgrcv
msgsnd
semctl
semget
semop
semtimedop
shmat
shmctl
shmdt
shmget

// Linux specific, mostly needed for thread-related stuff
arch_prctl             // (*)
get_robust_list
get_thread_area
gettid
futex                  // (*)
restart_syscall        // (*)
set_robust_list        // (*)
set_thread_area
set_tid_address        // (*)
tgkill
tkill

// Admin syscalls, these are blocked
//acct
//adjtimex
//bdflush
//chroot
//create_module
//delete_module
//get_kernel_syms      // Obsolete
//idle                 // Obsolete
//init_module
//ioperm
//iopl
//ioprio_get
//ioprio_set
//kexec_load
//lookup_dcookie       // oprofile only?
//migrate_pages        // NUMA
//modify_ldt
//mount
//move_pages           // NUMA
//name_to_handle_at    // NFS server
//nfsservctl           // NFS server
//open_by_handle_at    // NFS server
//perf_event_open
//pivot_root
//process_vm_readv     // For debugger
//process_vm_writev    // For debugger
//ptrace               // For debugger
//query_module
//quotactl
//reboot
//setdomainname
//setns
//settimeofday
//sgetmask             // Obsolete
//ssetmask             // Obsolete
//stime
//swapoff
//swapon
//_sysctl
//sysfs
//sys_setaltroot
//umount
//umount2
//unshare
//uselib
//vhangup
//vm86
//vm86old

// Kernel key management
//add_key
//keyctl
//request_key

// Unimplemented
//afs_syscall
//break
//ftime
//getpmsg
//gtty
//lock
//madvise1
//mpx
//prof
//profil
//putpmsg
//security
//stty
//tuxcall
//ulimit
//vserver