mirror of
https://github.com/criyle/go-judge.git
synced 2025-11-04 14:50:02 +08:00
155 lines
1.9 KiB
YAML
155 lines
1.9 KiB
YAML
# This is an example seccomp policy for x86_64 that whitelist regular syscalls and prevents network syscalls.
|
|
# The example is not ready for production use now, should be tuned for specific usages
|
|
|
|
# The default action is applied if none of the syscalls match.
|
|
#
|
|
# Possible actions:
|
|
# - kill_process (since Linux 4.14)
|
|
# - kill_thread
|
|
# - trap
|
|
# - errno (returns EPERM)
|
|
# - trace
|
|
# - log (since Linux 4.14)
|
|
# - allow
|
|
default_action: kill_process
|
|
|
|
syscalls:
|
|
- action: allow
|
|
names:
|
|
# file actions
|
|
- read
|
|
- write
|
|
- readv
|
|
- writev
|
|
- close
|
|
- fstat
|
|
- lseek
|
|
- dup
|
|
- dup2
|
|
- dup3
|
|
- ioctl
|
|
- fcntl
|
|
- fadvise64
|
|
- pipe
|
|
- pread64
|
|
- pwrite64
|
|
|
|
# memory action
|
|
- mmap
|
|
- mprotect
|
|
- munmap
|
|
- brk
|
|
- mremap
|
|
- msync
|
|
- mincore
|
|
- madvise
|
|
|
|
# signal
|
|
- rt_sigaction
|
|
- rt_sigprocmask
|
|
- rt_sigreturn
|
|
- rt_sigpending
|
|
- sigaltstack
|
|
|
|
# work dir
|
|
- getcwd
|
|
|
|
# exit
|
|
- exit
|
|
- exit_group
|
|
|
|
# others
|
|
- arch_prctl
|
|
- restart_syscall
|
|
|
|
# time
|
|
- gettimeofday
|
|
- times
|
|
- time
|
|
- clock_gettime
|
|
- clock_getres
|
|
|
|
# rlimit
|
|
- getrlimit
|
|
- getrusage
|
|
- setrlimit
|
|
|
|
# execve
|
|
- execve
|
|
- execveat
|
|
|
|
# open
|
|
- open
|
|
- openat
|
|
|
|
# delete
|
|
- unlink
|
|
- unlinkat
|
|
|
|
# link
|
|
- readlink
|
|
- readlinkat
|
|
|
|
# permission check
|
|
- lstat
|
|
- stat
|
|
- access
|
|
- faccessat
|
|
|
|
# process
|
|
- clone
|
|
- fork
|
|
- vfork
|
|
- nanosleep
|
|
- wait4
|
|
|
|
- getpid
|
|
- gettid
|
|
|
|
# lock
|
|
- futex
|
|
|
|
# other
|
|
- getdents
|
|
- getdents64
|
|
- sysinfo
|
|
- set_tid_address
|
|
- set_robust_list
|
|
- getrandom
|
|
|
|
- umask
|
|
- rename
|
|
- chmod
|
|
- mkdir
|
|
- chdir
|
|
- fchdir
|
|
- ftruncate
|
|
- sched_getaffinity
|
|
- sched_yield
|
|
- uname
|
|
- prlimit64
|
|
- fchmodat
|
|
- poll
|
|
|
|
# user
|
|
- getuid
|
|
- geteuid
|
|
- getgid
|
|
- getegid
|
|
|
|
- action: errno
|
|
names:
|
|
- connect
|
|
- accept
|
|
- sendto
|
|
- recvfrom
|
|
- sendmsg
|
|
- recvmsg
|
|
- bind
|
|
- listen
|
|
- setsockopt
|
|
- socketpair
|
|
- getsockopt
|
|
|
|
|