CoCalc -- aarch64-unknown-linux-musl.json

GitHub Repository: aos/firecracker
Path: blob/main/resources/seccomp/aarch64-unknown-linux-musl.json
¹⁹⁵⁶ views
1
{
2
    "vmm": {
3
        "default_action": "trap",
4
        "filter_action": "allow",
5
        "filter": [
6
            {
7
                "syscall": "epoll_ctl"
8
            },
9
            {
10
                "syscall": "epoll_pwait"
11
            },
12
            {
13
                "syscall": "exit"
14
            },
15
            {
16
                "syscall": "exit_group"
17
            },
18
            {
19
                "syscall": "openat"
20
            },
21
            {
22
                "syscall": "read"
23
            },
24
            {
25
                "syscall": "write"
26
            },
27
            {
28
                "syscall": "fsync"
29
            },
30
            {
31
                "syscall": "close"
32
            },
33
            {
34
                "syscall": "brk",
35
                "comment": "Called for expanding the heap"
36
            },
37
            {
38
                "syscall": "clock_gettime",
39
                "comment": "Used for metrics and logging, via the helpers in utils/src/time.rs. It's not called on some platforms, because of vdso optimisations."
40
            },
41
            {
42
                "syscall": "connect",
43
                "comment": "Needed for vsock"
44
            },
45
            {
46
                "syscall": "fstat",
47
                "comment": "Used for drive patching & rescanning, for reading the local timezone from /etc/localtime"
48
            },
49
            {
50
                "syscall": "ftruncate",
51
                "comment": "Used for snapshotting"
52
            },
53
            {
54
                "syscall": "lseek",
55
                "comment": "Used by the block device"
56
            },
57
            {
58
                "syscall": "mremap",
59
                "comment": "Used for re-allocating large memory regions, for example vectors"
60
            },
61
            {
62
                "syscall": "munmap",
63
                "comment": "Used for freeing memory"
64
            },
65
            {
66
                "syscall": "recvfrom",
67
                "comment": "Used by vsock to retrieve data from the socket"
68
            },
69
            {
70
                "syscall": "rt_sigreturn",
71
                "comment": "rt_sigreturn is needed in case a fault does occur, so that the signal handler can return. Otherwise we get stuck in a fault loop."
72
            },
73
            {
74
                "syscall": "sigaltstack",
75
                "comment": "sigaltstack is used by Rust stdlib to remove alternative signal stack during thread teardown."
76
            },
77
            {
78
                "syscall": "accept4",
79
                "comment": "Called to accept vsock connections",
80
                "args": [
81
                    {
82
                        "index": 3,
83
                        "type": "dword",
84
                        "op": "eq",
85
                        "val": 524288,
86
                        "comment": "libc::SOCK_CLOEXEC"
87
                    }
88
                ]
89
            },
90
            {
91
                "syscall": "fcntl",
92
                "comment": "Used by snapshotting, drive patching and rescanning",
93
                "args": [
94
                    {
95
                        "index": 1,
96
                        "type": "dword",
97
                        "op": "eq",
98
                        "val": 2,
99
                        "comment": "FCNTL_F_SETFD"
100
                    },
101
                    {
102
                        "index": 2,
103
                        "type": "dword",
104
                        "op": "eq",
105
                        "val": 1,
106
                        "comment": "FCNTL_FD_CLOEXEC"
107
                    }
108
                ]
109
            },
110
            {
111
                "syscall": "futex",
112
                "comment": "Used for synchronization (during thread teardown when joining multiple vcpu threads at once)",
113
                "args": [
114
                    {
115
                        "index": 1,
116
                        "type": "dword",
117
                        "op": "eq",
118
                        "val": 0,
119
                        "comment": "FUTEX_WAIT"
120
                    }
121
                ]
122
            },
123
            {
124
                "syscall": "futex",
125
                "comment": "Used for synchronization (during thread teardown)",
126
                "args": [
127
                    {
128
                        "index": 1,
129
                        "type": "dword",
130
                        "op": "eq",
131
                        "val": 1,
132
                        "comment": "FUTEX_WAKE"
133
                    }
134
                ]
135
            },
136
            {
137
                "syscall": "futex",
138
                "comment": "Used for synchronization",
139
                "args": [
140
                    {
141
                        "index": 1,
142
                        "type": "dword",
143
                        "op": "eq",
144
                        "val": 128,
145
                        "comment": "FUTEX_WAIT_PRIVATE"
146
                    }
147
                ]
148
            },
149
            {
150
                "syscall": "futex",
151
                "comment": "Used for synchronization",
152
                "args": [
153
                    {
154
                        "index": 1,
155
                        "type": "dword",
156
                        "op": "eq",
157
                        "val": 129,
158
                        "comment": "FUTEX_WAKE_PRIVATE"
159
                    }
160
                ]
161
            },
162
            {
163
                "syscall": "madvise",
164
                "comment": "Used by the VirtIO balloon device and by musl for some customer workloads",
165
                "args": [
166
                    {
167
                        "index": 2,
168
                        "type": "dword",
169
                        "op": "eq",
170
                        "val": 4,
171
                        "comment": "libc::MADV_DONTNEED"
172
                    }
173
                ]
174
            },
175
            {
176
                "syscall": "mmap",
177
                "comment": "Used by the VirtIO balloon device",
178
                "args": [
179
                    {
180
                        "index": 3,
181
                        "type": "dword",
182
                        "op": "eq",
183
                        "val": 50,
184
                        "comment": "libc::MAP_FIXED | libc::MAP_ANONYMOUS | libc::MAP_PRIVATE"
185
                    }
186
                ]
187
            },
188
            {
189
                "syscall": "mmap",
190
                "comment": "Used for reading the timezone in LocalTime::now()",
191
                "args": [
192
                    {
193
                        "index": 3,
194
                        "type": "dword",
195
                        "op": "eq",
196
                        "val": 1,
197
                        "comment": "libc::MAP_SHARED"
198
                    }
199
                ]
200
            },
201
            {
202
                "syscall": "socket",
203
                "comment": "Called to open the vsock UDS",
204
                "args": [
205
                    {
206
                        "index": 0,
207
                        "type": "dword",
208
                        "op": "eq",
209
                        "val": 1,
210
                        "comment": "libc::AF_UNIX"
211
                    },
212
                    {
213
                        "index": 1,
214
                        "type": "dword",
215
                        "op": "eq",
216
                        "val": 524289,
217
                        "comment": "libc::SOCK_STREAM | libc::SOCK_CLOEXEC"
218
                    },
219
                    {
220
                        "index": 2,
221
                        "type": "dword",
222
                        "op": "eq",
223
                        "val": 0
224
                    }
225
                ]
226
            },
227
            {
228
                "syscall": "tkill",
229
                "comment": "Used to kick vcpus",
230
                "args": [
231
                    {
232
                        "index": 1,
233
                        "type": "dword",
234
                        "op": "eq",
235
                        "val": 35,
236
                        "comment": "sigrtmin() + vcpu::VCPU_RTSIG_OFFSET"
237
                    }
238
                ]
239
            },
240
            {
241
                "syscall": "timerfd_settime",
242
                "comment": "Needed for rate limiting and metrics",
243
                "args": [
244
                    {
245
                        "index": 1,
246
                        "type": "dword",
247
                        "op": "eq",
248
                        "val": 0
249
                    }
250
                ]
251
            },
252
            {
253
                "syscall": "ioctl",
254
                "comment": "Used to make vsock UDS nonblocking",
255
                "args": [
256
                    {
257
                        "index": 1,
258
                        "type": "dword",
259
                        "op": "eq",
260
                        "val": 21537,
261
                        "comment": "FIONBIO"
262
                    }
263
                ]
264
            },
265
            {
266
                "syscall": "ioctl",
267
                "comment": "Triggered on shutdown, to restore the initial terminal settings.",
268
                "args": [
269
                    {
270
                        "index": 1,
271
                        "type": "dword",
272
                        "op": "eq",
273
                        "val": 21523,
274
                        "comment": "TIOCGWINSZ"
275
                    }
276
                ]
277
            },
278
            {
279
                "syscall": "ioctl",
280
                "comment": "Triggered on shutdown, to restore the initial terminal settings, only when Firecracker was launched from a shell.",
281
                "args": [
282
                    {
283
                        "index": 1,
284
                        "type": "dword",
285
                        "op": "eq",
286
                        "val": 21505,
287
                        "comment": "TCGETS"
288
                    }
289
                ]
290
            },
291
            {
292
                "syscall": "ioctl",
293
                "comment": "Triggered on shutdown, to restore the initial terminal settings, only when Firecracker was launched from a shell.",
294
                "args": [
295
                    {
296
                        "index": 1,
297
                        "type": "dword",
298
                        "op": "eq",
299
                        "val": 21506,
300
                        "comment": "TCSETS"
301
                    }
302
                ]
303
            },
304
            {
305
                "syscall": "ioctl",
306
                "args": [
307
                    {
308
                        "index": 1,
309
                        "type": "dword",
310
                        "op": "eq",
311
                        "val": 1074835010,
312
                        "comment": "KVM_GET_DIRTY_LOG"
313
                    }
314
                ]
315
            },
316
            {
317
                "syscall": "ioctl",
318
                "args": [
319
                    {
320
                        "index": 1,
321
                        "type": "dword",
322
                        "op": "eq",
323
                        "val": 1075359457,
324
                        "comment": "KVM_SET_DEVICE_ATTR"
325
                    }
326
                ]
327
            },
328
            {
329
                "syscall": "ioctl",
330
                "args": [
331
                    {
332
                        "index": 1,
333
                        "type": "dword",
334
                        "op": "eq",
335
                        "val": 1075359458,
336
                        "comment": "KVM_GET_DEVICE_ATTR"
337
                    }
338
                ]
339
            }
340
        ]
341
    },
342
    "api": {
343
        "default_action": "trap",
344
        "filter_action": "allow",
345
        "filter": [
346
            {
347
                "syscall": "epoll_ctl"
348
            },
349
            {
350
                "syscall": "epoll_pwait"
351
            },
352
            {
353
                "syscall": "exit"
354
            },
355
            {
356
                "syscall": "exit_group"
357
            },
358
            {
359
                "syscall": "openat"
360
            },
361
            {
362
                "syscall": "read"
363
            },
364
            {
365
                "syscall": "write"
366
            },
367
            {
368
                "syscall": "close"
369
            },
370
            {
371
                "syscall": "brk",
372
                "comment": "Called for expanding the heap"
373
            },
374
            {
375
                "syscall": "clock_gettime",
376
                "comment": "Used for metrics and logging, via the helpers in utils/src/time.rs. It's not called on some platforms, because of vdso optimisations."
377
            },
378
            {
379
                "syscall": "fstat",
380
                "comment": "Used for reading the local timezone from /etc/localtime"
381
            },
382
            {
383
                "syscall": "mremap",
384
                "comment": "Used for re-allocating large memory regions, for example vectors"
385
            },
386
            {
387
                "syscall": "munmap",
388
                "comment": "Used for freeing memory"
389
            },
390
            {
391
                "syscall": "recvfrom",
392
                "comment": "Used to retrieve data from the socket"
393
            },
394
            {
395
                "syscall": "rt_sigprocmask",
396
                "comment": "rt_sigprocmask is used by Rust stdlib to remove custom signal handler during thread teardown."
397
            },
398
            {
399
                "syscall": "sigaltstack",
400
                "comment": "sigaltstack is used by Rust stdlib to remove alternative signal stack during thread teardown."
401
            },
402
            {
403
                "syscall": "accept4",
404
                "comment": "Called to accept socket connections",
405
                "args": [
406
                    {
407
                        "index": 3,
408
                        "type": "dword",
409
                        "op": "eq",
410
                        "val": 524288,
411
                        "comment": "libc::SOCK_CLOEXEC"
412
                    }
413
                ]
414
            },
415
            {
416
                "syscall": "futex",
417
                "comment": "Used for synchronization (during thread teardown)",
418
                "args": [
419
                    {
420
                        "index": 1,
421
                        "type": "dword",
422
                        "op": "eq",
423
                        "val": 0,
424
                        "comment": "FUTEX_WAIT"
425
                    }
426
                ]
427
            },
428
            {
429
                "syscall": "futex",
430
                "comment": "Used for synchronization (during thread teardown)",
431
                "args": [
432
                    {
433
                        "index": 1,
434
                        "type": "dword",
435
                        "op": "eq",
436
                        "val": 1,
437
                        "comment": "FUTEX_WAKE"
438
                    }
439
                ]
440
            },
441
            {
442
                "syscall": "futex",
443
                "comment": "Used for synchronization",
444
                "args": [
445
                    {
446
                        "index": 1,
447
                        "type": "dword",
448
                        "op": "eq",
449
                        "val": 128,
450
                        "comment": "FUTEX_WAIT_PRIVATE"
451
                    }
452
                ]
453
            },
454
            {
455
                "syscall": "futex",
456
                "comment": "Used for synchronization",
457
                "args": [
458
                    {
459
                        "index": 1,
460
                        "type": "dword",
461
                        "op": "eq",
462
                        "val": 129,
463
                        "comment": "FUTEX_WAKE_PRIVATE"
464
                    }
465
                ]
466
            },
467
            {
468
                "syscall": "madvise",
469
                "comment": "Triggered by musl for some customer workloads",
470
                "args": [
471
                    {
472
                        "index": 2,
473
                        "type": "dword",
474
                        "op": "eq",
475
                        "val": 4,
476
                        "comment": "libc::MADV_DONTNEED"
477
                    }
478
                ]
479
            },
480
            {
481
                "syscall": "mmap",
482
                "comment": "Used for reading the timezone in LocalTime::now()",
483
                "args": [
484
                    {
485
                        "index": 3,
486
                        "type": "dword",
487
                        "op": "eq",
488
                        "val": 1,
489
                        "comment": "libc::MAP_SHARED"
490
                    }
491
                ]
492
            },
493
            {
494
                "syscall": "socket",
495
                "comment": "Called to open the unix domain socket",
496
                "args": [
497
                    {
498
                        "index": 0,
499
                        "type": "dword",
500
                        "op": "eq",
501
                        "val": 1,
502
                        "comment": "libc::AF_UNIX"
503
                    },
504
                    {
505
                        "index": 1,
506
                        "type": "dword",
507
                        "op": "eq",
508
                        "val": 524289,
509
                        "comment": "libc::SOCK_STREAM | libc::SOCK_CLOEXEC"
510
                    },
511
                    {
512
                        "index": 2,
513
                        "type": "dword",
514
                        "op": "eq",
515
                        "val": 0
516
                    }
517
                ]
518
            },
519
            {
520
                "syscall": "ioctl",
521
                "comment": "Used to make api socket nonblocking",
522
                "args": [
523
                    {
524
                        "index": 1,
525
                        "type": "dword",
526
                        "op": "eq",
527
                        "val": 21537,
528
                        "comment": "FIONBIO"
529
                    }
530
                ]
531
            }
532
        ]
533
    },
534
    "vcpu": {
535
        "default_action": "trap",
536
        "filter_action": "allow",
537
        "filter": [
538
            {
539
                "syscall": "exit"
540
            },
541
            {
542
                "syscall": "exit_group"
543
            },
544
            {
545
                "syscall": "write"
546
            },
547
            {
548
                "syscall": "openat"
549
            },
550
            {
551
                "syscall": "close"
552
            },
553
            {
554
                "syscall": "fstat",
555
                "comment": "Used for reading the local timezone from /etc/localtime"
556
            },
557
            {
558
                "syscall": "brk",
559
                "comment": "Called for expanding the heap"
560
            },
561
            {
562
                "syscall": "clock_gettime",
563
                "comment": "Used for metrics and logging, via the helpers in utils/src/time.rs. It's not called on some platforms, because of vdso optimisations."
564
            },
565
            {
566
                "syscall": "mremap",
567
                "comment": "Used for re-allocating large memory regions, for example vectors"
568
            },
569
            {
570
                "syscall": "munmap",
571
                "comment": "Used for freeing memory"
572
            },
573
            {
574
                "syscall": "rt_sigprocmask",
575
                "comment": "rt_sigprocmask is used by Rust stdlib to remove custom signal handler during thread teardown."
576
            },
577
            {
578
                "syscall": "rt_sigreturn",
579
                "comment": "rt_sigreturn is needed in case a fault does occur, so that the signal handler can return. Otherwise we get stuck in a fault loop."
580
            },
581
            {
582
                "syscall": "sigaltstack",
583
                "comment": "sigaltstack is used by Rust stdlib to remove alternative signal stack during thread teardown."
584
            },
585
            {
586
                "syscall": "futex",
587
                "comment": "Used for synchronization (during thread teardown when joining multiple vcpu threads at once)",
588
                "args": [
589
                    {
590
                        "index": 1,
591
                        "type": "dword",
592
                        "op": "eq",
593
                        "val": 0,
594
                        "comment": "FUTEX_WAIT"
595
                    }
596
                ]
597
            },
598
            {
599
                "syscall": "futex",
600
                "comment": "Used for synchronization (during thread teardown)",
601
                "args": [
602
                    {
603
                        "index": 1,
604
                        "type": "dword",
605
                        "op": "eq",
606
                        "val": 1,
607
                        "comment": "FUTEX_WAKE"
608
                    }
609
                ]
610
            },
611
            {
612
                "syscall": "futex",
613
                "comment": "Used for synchronization",
614
                "args": [
615
                    {
616
                        "index": 1,
617
                        "type": "dword",
618
                        "op": "eq",
619
                        "val": 128,
620
                        "comment": "FUTEX_WAIT_PRIVATE"
621
                    }
622
                ]
623
            },
624
            {
625
                "syscall": "futex",
626
                "comment": "Used for synchronization",
627
                "args": [
628
                    {
629
                        "index": 1,
630
                        "type": "dword",
631
                        "op": "eq",
632
                        "val": 129,
633
                        "comment": "FUTEX_WAKE_PRIVATE"
634
                    }
635
                ]
636
            },
637
            {
638
                "syscall": "madvise",
639
                "comment": "Triggered by musl for some customer workloads",
640
                "args": [
641
                    {
642
                        "index": 2,
643
                        "type": "dword",
644
                        "op": "eq",
645
                        "val": 4,
646
                        "comment": "libc::MADV_DONTNEED"
647
                    }
648
                ]
649
            },
650
            {
651
                "syscall": "mmap",
652
                "comment": "Used for reading the timezone in LocalTime::now()",
653
                "args": [
654
                    {
655
                        "index": 3,
656
                        "type": "dword",
657
                        "op": "eq",
658
                        "val": 1,
659
                        "comment": "libc::MAP_SHARED"
660
                    }
661
                ]
662
            },
663
            {
664
                "syscall": "timerfd_settime",
665
                "comment": "Needed for updating the balloon statistics interval",
666
                "args": [
667
                    {
668
                        "index": 1,
669
                        "type": "dword",
670
                        "op": "eq",
671
                        "val": 0
672
                    }
673
                ]
674
            },
675
            {
676
                "syscall": "ioctl",
677
                "args": [
678
                    {
679
                        "index": 1,
680
                        "type": "dword",
681
                        "op": "eq",
682
                        "val": 44672,
683
                        "comment": "KVM_RUN"
684
                    }
685
                ]
686
            },
687
            {
688
                "syscall": "ioctl",
689
                "args": [
690
                    {
691
                        "index": 1,
692
                        "type": "dword",
693
                        "op": "eq",
694
                        "val": 2147790488,
695
                        "comment": "KVM_GET_MP_STATE"
696
                    }
697
                ]
698
            },
699
            {
700
                "syscall": "ioctl",
701
                "args": [
702
                    {
703
                        "index": 1,
704
                        "type": "dword",
705
                        "op": "eq",
706
                        "val": 1074048665,
707
                        "comment": "KVM_SET_MP_STATE"
708
                    }
709
                ]
710
            },
711
            {
712
                "syscall": "ioctl",
713
                "args": [
714
                    {
715
                        "index": 1,
716
                        "type": "dword",
717
                        "op": "eq",
718
                        "val": 2151722655,
719
                        "comment": "KVM_GET_VCPU_EVENTS"
720
                    }
721
                ]
722
            },
723
            {
724
                "syscall": "ioctl",
725
                "args": [
726
                    {
727
                        "index": 1,
728
                        "type": "dword",
729
                        "op": "eq",
730
                        "val": 1077980832,
731
                        "comment": "KVM_SET_VCPU_EVENTS"
732
                    }
733
                ]
734
            },
735
            {
736
                "syscall": "ioctl",
737
                "args": [
738
                    {
739
                        "index": 1,
740
                        "type": "dword",
741
                        "op": "eq",
742
                        "val": 1074835115,
743
                        "comment": "KVM_GET_ONE_REG"
744
                    }
745
                ]
746
            },
747
            {
748
                "syscall": "ioctl",
749
                "args": [
750
                    {
751
                        "index": 1,
752
                        "type": "dword",
753
                        "op": "eq",
754
                        "val": 1074835116,
755
                        "comment": "KVM_SET_ONE_REG"
756
                    }
757
                ]
758
            },
759
            {
760
                "syscall": "ioctl",
761
                "args": [
762
                    {
763
                        "index": 1,
764
                        "type": "dword",
765
                        "op": "eq",
766
                        "val": 3221794480,
767
                        "comment": "KVM_GET_REG_LIST"
768
                    }
769
                ]
770
            }
771
        ]
772
    }
773
}
774

775
Product

Resources

Company
