go-judge/seccomp_example.yaml
2020-12-13 21:08:52 -08:00

155 lines
1.9 KiB
YAML

# This is an example seccomp policy for x86_64 that whitelist regular syscalls and prevents network syscalls.
# The example is not ready for production use now, should be tuned for specific usages
# The default action is applied if none of the syscalls match.
#
# Possible actions:
# - kill_process (since Linux 4.14)
# - kill_thread
# - trap
# - errno (returns EPERM)
# - trace
# - log (since Linux 4.14)
# - allow
default_action: kill_process
syscalls:
- action: allow
names:
# file actions
- read
- write
- readv
- writev
- close
- fstat
- lseek
- dup
- dup2
- dup3
- ioctl
- fcntl
- fadvise64
- pipe
- pread64
- pwrite64
# memory action
- mmap
- mprotect
- munmap
- brk
- mremap
- msync
- mincore
- madvise
# signal
- rt_sigaction
- rt_sigprocmask
- rt_sigreturn
- rt_sigpending
- sigaltstack
# work dir
- getcwd
# exit
- exit
- exit_group
# others
- arch_prctl
- restart_syscall
# time
- gettimeofday
- times
- time
- clock_gettime
- clock_getres
# rlimit
- getrlimit
- getrusage
- setrlimit
# execve
- execve
- execveat
# open
- open
- openat
# delete
- unlink
- unlinkat
# link
- readlink
- readlinkat
# permission check
- lstat
- stat
- access
- faccessat
# process
- clone
- fork
- vfork
- nanosleep
- wait4
- getpid
- gettid
# lock
- futex
# other
- getdents
- getdents64
- sysinfo
- set_tid_address
- set_robust_list
- getrandom
- umask
- rename
- chmod
- mkdir
- chdir
- fchdir
- ftruncate
- sched_getaffinity
- sched_yield
- uname
- prlimit64
- fchmodat
- poll
# user
- getuid
- geteuid
- getgid
- getegid
- action: errno
names:
- connect
- accept
- sendto
- recvfrom
- sendmsg
- recvmsg
- bind
- listen
- setsockopt
- socketpair
- getsockopt