# This is an example seccomp policy for x86_64 that whitelist regular syscalls and prevents network syscalls. # The example is not ready for production use now, should be tuned for specific usages # The default action is applied if none of the syscalls match. # # Possible actions: # - kill_process (since Linux 4.14) # - kill_thread # - trap # - errno (returns EPERM) # - trace # - log (since Linux 4.14) # - allow default_action: kill_process syscalls: - action: allow names: # file actions - read - write - readv - writev - close - fstat - lseek - dup - dup2 - dup3 - ioctl - fcntl - fadvise64 - pipe - pread64 - pwrite64 # memory action - mmap - mprotect - munmap - brk - mremap - msync - mincore - madvise # signal - rt_sigaction - rt_sigprocmask - rt_sigreturn - rt_sigpending - sigaltstack # work dir - getcwd # exit - exit - exit_group # others - arch_prctl - restart_syscall # time - gettimeofday - times - time - clock_gettime - clock_getres # rlimit - getrlimit - getrusage - setrlimit # execve - execve - execveat # open - open - openat # delete - unlink - unlinkat # link - readlink - readlinkat # permission check - lstat - stat - access - faccessat # process - clone - fork - vfork - nanosleep - wait4 - getpid - gettid # lock - futex # other - getdents - getdents64 - sysinfo - set_tid_address - set_robust_list - getrandom - umask - rename - chmod - mkdir - chdir - fchdir - ftruncate - sched_getaffinity - sched_yield - uname - prlimit64 - fchmodat - poll # user - getuid - geteuid - getgid - getegid - action: errno names: - connect - accept - sendto - recvfrom - sendmsg - recvmsg - bind - listen - setsockopt - socketpair - getsockopt