Book a Demo!
CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutPoliciesSign UpSign In
aos
GitHub Repository: aos/firecracker
Path: blob/main/resources/seccomp/x86_64-unknown-linux-musl.json
1956 views
1
{
2
"vmm": {
3
"default_action": "trap",
4
"filter_action": "allow",
5
"filter": [
6
{
7
"syscall": "epoll_ctl"
8
},
9
{
10
"syscall": "epoll_pwait"
11
},
12
{
13
"syscall": "exit"
14
},
15
{
16
"syscall": "exit_group"
17
},
18
{
19
"syscall": "open"
20
},
21
{
22
"syscall": "read"
23
},
24
{
25
"syscall": "write"
26
},
27
{
28
"syscall": "fsync"
29
},
30
{
31
"syscall": "close"
32
},
33
{
34
"syscall": "brk",
35
"comment": "Called for expanding the heap"
36
},
37
{
38
"syscall": "clock_gettime",
39
"comment": "Used for metrics and logging, via the helpers in utils/src/time.rs. It's not called on some platforms, because of vdso optimisations."
40
},
41
{
42
"syscall": "connect",
43
"comment": "Needed for vsock"
44
},
45
{
46
"syscall": "fstat",
47
"comment": "Used for drive patching & rescanning, for reading the local timezone from /etc/localtime"
48
},
49
{
50
"syscall": "ftruncate",
51
"comment": "Used for snapshotting"
52
},
53
{
54
"syscall": "lseek",
55
"comment": "Used by the block device"
56
},
57
{
58
"syscall": "mremap",
59
"comment": "Used for re-allocating large memory regions, for example vectors"
60
},
61
{
62
"syscall": "munmap",
63
"comment": "Used for freeing memory"
64
},
65
{
66
"syscall": "recvfrom",
67
"comment": "Used by vsock to retrieve data from the socket"
68
},
69
{
70
"syscall": "rt_sigreturn",
71
"comment": "rt_sigreturn is needed in case a fault does occur, so that the signal handler can return. Otherwise we get stuck in a fault loop."
72
},
73
{
74
"syscall": "sigaltstack",
75
"comment": "sigaltstack is used by Rust stdlib to remove alternative signal stack during thread teardown."
76
},
77
{
78
"syscall": "accept4",
79
"comment": "Called to accept vsock connections",
80
"args": [
81
{
82
"index": 3,
83
"type": "dword",
84
"op": "eq",
85
"val": 524288,
86
"comment": "libc::SOCK_CLOEXEC"
87
}
88
]
89
},
90
{
91
"syscall": "fcntl",
92
"comment": "Used by snapshotting, drive patching and rescanning",
93
"args": [
94
{
95
"index": 1,
96
"type": "dword",
97
"op": "eq",
98
"val": 2,
99
"comment": "FCNTL_F_SETFD"
100
},
101
{
102
"index": 2,
103
"type": "dword",
104
"op": "eq",
105
"val": 1,
106
"comment": "FCNTL_FD_CLOEXEC"
107
}
108
]
109
},
110
{
111
"syscall": "futex",
112
"comment": "Used for synchronization (during thread teardown when joining multiple vcpu threads at once)",
113
"args": [
114
{
115
"index": 1,
116
"type": "dword",
117
"op": "eq",
118
"val": 0,
119
"comment": "FUTEX_WAIT"
120
}
121
]
122
},
123
{
124
"syscall": "futex",
125
"comment": "Used for synchronization (during thread teardown)",
126
"args": [
127
{
128
"index": 1,
129
"type": "dword",
130
"op": "eq",
131
"val": 1,
132
"comment": "FUTEX_WAKE"
133
}
134
]
135
},
136
{
137
"syscall": "futex",
138
"comment": "Used for synchronization",
139
"args": [
140
{
141
"index": 1,
142
"type": "dword",
143
"op": "eq",
144
"val": 128,
145
"comment": "FUTEX_WAIT_PRIVATE"
146
}
147
]
148
},
149
{
150
"syscall": "futex",
151
"comment": "Used for synchronization",
152
"args": [
153
{
154
"index": 1,
155
"type": "dword",
156
"op": "eq",
157
"val": 129,
158
"comment": "FUTEX_WAKE_PRIVATE"
159
}
160
]
161
},
162
{
163
"syscall": "madvise",
164
"comment": "Used by the VirtIO balloon device and by musl for some customer workloads",
165
"args": [
166
{
167
"index": 2,
168
"type": "dword",
169
"op": "eq",
170
"val": 4,
171
"comment": "libc::MADV_DONTNEED"
172
}
173
]
174
},
175
{
176
"syscall": "mmap",
177
"comment": "Used by the VirtIO balloon device",
178
"args": [
179
{
180
"index": 3,
181
"type": "dword",
182
"op": "eq",
183
"val": 50,
184
"comment": "libc::MAP_FIXED | libc::MAP_ANONYMOUS | libc::MAP_PRIVATE"
185
}
186
]
187
},
188
{
189
"syscall": "mmap",
190
"comment": "Used for reading the timezone in LocalTime::now()",
191
"args": [
192
{
193
"index": 3,
194
"type": "dword",
195
"op": "eq",
196
"val": 1,
197
"comment": "libc::MAP_SHARED"
198
}
199
]
200
},
201
{
202
"syscall": "socket",
203
"comment": "Called to open the vsock UDS",
204
"args": [
205
{
206
"index": 0,
207
"type": "dword",
208
"op": "eq",
209
"val": 1,
210
"comment": "libc::AF_UNIX"
211
},
212
{
213
"index": 1,
214
"type": "dword",
215
"op": "eq",
216
"val": 524289,
217
"comment": "libc::SOCK_STREAM | libc::SOCK_CLOEXEC"
218
},
219
{
220
"index": 2,
221
"type": "dword",
222
"op": "eq",
223
"val": 0
224
}
225
]
226
},
227
{
228
"syscall": "tkill",
229
"comment": "Used to kick vcpus",
230
"args": [
231
{
232
"index": 1,
233
"type": "dword",
234
"op": "eq",
235
"val": 35,
236
"comment": "sigrtmin() + vcpu::VCPU_RTSIG_OFFSET"
237
}
238
]
239
},
240
{
241
"syscall": "timerfd_settime",
242
"comment": "Needed for rate limiting and metrics",
243
"args": [
244
{
245
"index": 1,
246
"type": "dword",
247
"op": "eq",
248
"val": 0
249
}
250
]
251
},
252
{
253
"syscall": "ioctl",
254
"comment": "Used to make vsock UDS nonblocking",
255
"args": [
256
{
257
"index": 1,
258
"type": "dword",
259
"op": "eq",
260
"val": 21537,
261
"comment": "FIONBIO"
262
}
263
]
264
},
265
{
266
"syscall": "ioctl",
267
"comment": "Triggered on shutdown, to restore the initial terminal settings.",
268
"args": [
269
{
270
"index": 1,
271
"type": "dword",
272
"op": "eq",
273
"val": 21523,
274
"comment": "TIOCGWINSZ"
275
}
276
]
277
},
278
{
279
"syscall": "ioctl",
280
"comment": "Triggered on shutdown, to restore the initial terminal settings, only when Firecracker was launched from a shell.",
281
"args": [
282
{
283
"index": 1,
284
"type": "dword",
285
"op": "eq",
286
"val": 21505,
287
"comment": "TCGETS"
288
}
289
]
290
},
291
{
292
"syscall": "ioctl",
293
"comment": "Triggered on shutdown, to restore the initial terminal settings, only when Firecracker was launched from a shell.",
294
"args": [
295
{
296
"index": 1,
297
"type": "dword",
298
"op": "eq",
299
"val": 21506,
300
"comment": "TCSETS"
301
}
302
]
303
},
304
{
305
"syscall": "ioctl",
306
"args": [
307
{
308
"index": 1,
309
"type": "dword",
310
"op": "eq",
311
"val": 1074835010,
312
"comment": "KVM_GET_DIRTY_LOG"
313
}
314
]
315
},
316
{
317
"syscall": "ioctl",
318
"args": [
319
{
320
"index": 1,
321
"type": "dword",
322
"op": "eq",
323
"val": 3255348834,
324
"comment": "KVM_GET_IRQCHIP"
325
}
326
]
327
},
328
{
329
"syscall": "ioctl",
330
"args": [
331
{
332
"index": 1,
333
"type": "dword",
334
"op": "eq",
335
"val": 2150674044,
336
"comment": "KVM_GET_CLOCK"
337
}
338
]
339
},
340
{
341
"syscall": "ioctl",
342
"args": [
343
{
344
"index": 1,
345
"type": "dword",
346
"op": "eq",
347
"val": 2154868383,
348
"comment": "KVM_GET_PIT2"
349
}
350
]
351
}
352
]
353
},
354
"api": {
355
"default_action": "trap",
356
"filter_action": "allow",
357
"filter": [
358
{
359
"syscall": "epoll_ctl"
360
},
361
{
362
"syscall": "epoll_pwait"
363
},
364
{
365
"syscall": "exit"
366
},
367
{
368
"syscall": "exit_group"
369
},
370
{
371
"syscall": "open"
372
},
373
{
374
"syscall": "read"
375
},
376
{
377
"syscall": "write"
378
},
379
{
380
"syscall": "close"
381
},
382
{
383
"syscall": "brk",
384
"comment": "Called for expanding the heap"
385
},
386
{
387
"syscall": "clock_gettime",
388
"comment": "Used for metrics and logging, via the helpers in utils/src/time.rs. It's not called on some platforms, because of vdso optimisations."
389
},
390
{
391
"syscall": "fstat",
392
"comment": "Used for reading the local timezone from /etc/localtime"
393
},
394
{
395
"syscall": "mremap",
396
"comment": "Used for re-allocating large memory regions, for example vectors"
397
},
398
{
399
"syscall": "munmap",
400
"comment": "Used for freeing memory"
401
},
402
{
403
"syscall": "recvfrom",
404
"comment": "Used to retrieve data from the socket"
405
},
406
{
407
"syscall": "rt_sigprocmask",
408
"comment": "rt_sigprocmask is used by Rust stdlib to remove custom signal handler during thread teardown."
409
},
410
{
411
"syscall": "sigaltstack",
412
"comment": "sigaltstack is used by Rust stdlib to remove alternative signal stack during thread teardown."
413
},
414
{
415
"syscall": "accept4",
416
"comment": "Called to accept socket connections",
417
"args": [
418
{
419
"index": 3,
420
"type": "dword",
421
"op": "eq",
422
"val": 524288,
423
"comment": "libc::SOCK_CLOEXEC"
424
}
425
]
426
},
427
{
428
"syscall": "futex",
429
"comment": "Used for synchronization (during thread teardown)",
430
"args": [
431
{
432
"index": 1,
433
"type": "dword",
434
"op": "eq",
435
"val": 0,
436
"comment": "FUTEX_WAIT"
437
}
438
]
439
},
440
{
441
"syscall": "futex",
442
"comment": "Used for synchronization (during thread teardown)",
443
"args": [
444
{
445
"index": 1,
446
"type": "dword",
447
"op": "eq",
448
"val": 1,
449
"comment": "FUTEX_WAKE"
450
}
451
]
452
},
453
{
454
"syscall": "futex",
455
"comment": "Used for synchronization",
456
"args": [
457
{
458
"index": 1,
459
"type": "dword",
460
"op": "eq",
461
"val": 128,
462
"comment": "FUTEX_WAIT_PRIVATE"
463
}
464
]
465
},
466
{
467
"syscall": "futex",
468
"comment": "Used for synchronization",
469
"args": [
470
{
471
"index": 1,
472
"type": "dword",
473
"op": "eq",
474
"val": 129,
475
"comment": "FUTEX_WAKE_PRIVATE"
476
}
477
]
478
},
479
{
480
"syscall": "madvise",
481
"comment": "Triggered by musl for some customer workloads",
482
"args": [
483
{
484
"index": 2,
485
"type": "dword",
486
"op": "eq",
487
"val": 4,
488
"comment": "libc::MADV_DONTNEED"
489
}
490
]
491
},
492
{
493
"syscall": "mmap",
494
"comment": "Used for reading the timezone in LocalTime::now()",
495
"args": [
496
{
497
"index": 3,
498
"type": "dword",
499
"op": "eq",
500
"val": 1,
501
"comment": "libc::MAP_SHARED"
502
}
503
]
504
},
505
{
506
"syscall": "socket",
507
"comment": "Called to open the unix domain socket",
508
"args": [
509
{
510
"index": 0,
511
"type": "dword",
512
"op": "eq",
513
"val": 1,
514
"comment": "libc::AF_UNIX"
515
},
516
{
517
"index": 1,
518
"type": "dword",
519
"op": "eq",
520
"val": 524289,
521
"comment": "libc::SOCK_STREAM | libc::SOCK_CLOEXEC"
522
},
523
{
524
"index": 2,
525
"type": "dword",
526
"op": "eq",
527
"val": 0
528
}
529
]
530
},
531
{
532
"syscall": "ioctl",
533
"comment": "Used to make api socket nonblocking",
534
"args": [
535
{
536
"index": 1,
537
"type": "dword",
538
"op": "eq",
539
"val": 21537,
540
"comment": "FIONBIO"
541
}
542
]
543
}
544
]
545
},
546
"vcpu": {
547
"default_action": "trap",
548
"filter_action": "allow",
549
"filter": [
550
{
551
"syscall": "exit"
552
},
553
{
554
"syscall": "exit_group"
555
},
556
{
557
"syscall": "write"
558
},
559
{
560
"syscall": "open"
561
},
562
{
563
"syscall": "close"
564
},
565
{
566
"syscall": "fstat",
567
"comment": "Used for reading the local timezone from /etc/localtime"
568
},
569
{
570
"syscall": "brk",
571
"comment": "Called for expanding the heap"
572
},
573
{
574
"syscall": "clock_gettime",
575
"comment": "Used for metrics and logging, via the helpers in utils/src/time.rs. It's not called on some platforms, because of vdso optimisations."
576
},
577
{
578
"syscall": "mremap",
579
"comment": "Used for re-allocating large memory regions, for example vectors"
580
},
581
{
582
"syscall": "munmap",
583
"comment": "Used for freeing memory"
584
},
585
{
586
"syscall": "rt_sigprocmask",
587
"comment": "rt_sigprocmask is used by Rust stdlib to remove custom signal handler during thread teardown."
588
},
589
{
590
"syscall": "rt_sigreturn",
591
"comment": "rt_sigreturn is needed in case a fault does occur, so that the signal handler can return. Otherwise we get stuck in a fault loop."
592
},
593
{
594
"syscall": "sigaltstack",
595
"comment": "sigaltstack is used by Rust stdlib to remove alternative signal stack during thread teardown."
596
},
597
{
598
"syscall": "futex",
599
"comment": "Used for synchronization (during thread teardown when joining multiple vcpu threads at once)",
600
"args": [
601
{
602
"index": 1,
603
"type": "dword",
604
"op": "eq",
605
"val": 0,
606
"comment": "FUTEX_WAIT"
607
}
608
]
609
},
610
{
611
"syscall": "futex",
612
"comment": "Used for synchronization (during thread teardown)",
613
"args": [
614
{
615
"index": 1,
616
"type": "dword",
617
"op": "eq",
618
"val": 1,
619
"comment": "FUTEX_WAKE"
620
}
621
]
622
},
623
{
624
"syscall": "futex",
625
"comment": "Used for synchronization",
626
"args": [
627
{
628
"index": 1,
629
"type": "dword",
630
"op": "eq",
631
"val": 128,
632
"comment": "FUTEX_WAIT_PRIVATE"
633
}
634
]
635
},
636
{
637
"syscall": "futex",
638
"comment": "Used for synchronization",
639
"args": [
640
{
641
"index": 1,
642
"type": "dword",
643
"op": "eq",
644
"val": 129,
645
"comment": "FUTEX_WAKE_PRIVATE"
646
}
647
]
648
},
649
{
650
"syscall": "madvise",
651
"comment": "Triggered by musl for some customer workloads",
652
"args": [
653
{
654
"index": 2,
655
"type": "dword",
656
"op": "eq",
657
"val": 4,
658
"comment": "libc::MADV_DONTNEED"
659
}
660
]
661
},
662
{
663
"syscall": "mmap",
664
"comment": "Used for reading the timezone in LocalTime::now()",
665
"args": [
666
{
667
"index": 3,
668
"type": "dword",
669
"op": "eq",
670
"val": 1,
671
"comment": "libc::MAP_SHARED"
672
}
673
]
674
},
675
{
676
"syscall": "timerfd_settime",
677
"comment": "Needed for updating the balloon statistics interval",
678
"args": [
679
{
680
"index": 1,
681
"type": "dword",
682
"op": "eq",
683
"val": 0
684
}
685
]
686
},
687
{
688
"syscall": "ioctl",
689
"args": [
690
{
691
"index": 1,
692
"type": "dword",
693
"op": "eq",
694
"val": 44672,
695
"comment": "KVM_RUN"
696
}
697
]
698
},
699
{
700
"syscall": "ioctl",
701
"args": [
702
{
703
"index": 1,
704
"type": "dword",
705
"op": "eq",
706
"val": 2147790488,
707
"comment": "KVM_GET_MP_STATE"
708
}
709
]
710
},
711
{
712
"syscall": "ioctl",
713
"args": [
714
{
715
"index": 1,
716
"type": "dword",
717
"op": "eq",
718
"val": 1074048665,
719
"comment": "KVM_SET_MP_STATE"
720
}
721
]
722
},
723
{
724
"syscall": "ioctl",
725
"args": [
726
{
727
"index": 1,
728
"type": "dword",
729
"op": "eq",
730
"val": 2151722655,
731
"comment": "KVM_GET_VCPU_EVENTS"
732
}
733
]
734
},
735
{
736
"syscall": "ioctl",
737
"args": [
738
{
739
"index": 1,
740
"type": "dword",
741
"op": "eq",
742
"val": 1077980832,
743
"comment": "KVM_SET_VCPU_EVENTS"
744
}
745
]
746
},
747
{
748
"syscall": "ioctl",
749
"args": [
750
{
751
"index": 1,
752
"type": "dword",
753
"op": "eq",
754
"val": 2214637198,
755
"comment": "KVM_GET_LAPIC"
756
}
757
]
758
},
759
{
760
"syscall": "ioctl",
761
"args": [
762
{
763
"index": 1,
764
"type": "dword",
765
"op": "eq",
766
"val": 2167975555,
767
"comment": "KVM_GET_SREGS"
768
}
769
]
770
},
771
{
772
"syscall": "ioctl",
773
"args": [
774
{
775
"index": 1,
776
"type": "dword",
777
"op": "eq",
778
"val": 1074310800,
779
"comment": "KVM_SET_CPUID2"
780
}
781
]
782
},
783
{
784
"syscall": "ioctl",
785
"args": [
786
{
787
"index": 1,
788
"type": "dword",
789
"op": "eq",
790
"val": 1140895375,
791
"comment": "KVM_SET_LAPIC"
792
}
793
]
794
},
795
{
796
"syscall": "ioctl",
797
"args": [
798
{
799
"index": 1,
800
"type": "dword",
801
"op": "eq",
802
"val": 1074310793,
803
"comment": "KVM_SET_MSRS"
804
}
805
]
806
},
807
{
808
"syscall": "ioctl",
809
"args": [
810
{
811
"index": 1,
812
"type": "dword",
813
"op": "eq",
814
"val": 1083223682,
815
"comment": "KVM_SET_REGS"
816
}
817
]
818
},
819
{
820
"syscall": "ioctl",
821
"args": [
822
{
823
"index": 1,
824
"type": "dword",
825
"op": "eq",
826
"val": 1094233732,
827
"comment": "KVM_SET_SREGS"
828
}
829
]
830
},
831
{
832
"syscall": "ioctl",
833
"args": [
834
{
835
"index": 1,
836
"type": "dword",
837
"op": "eq",
838
"val": 2154868383,
839
"comment": "KVM_GET_PIT2"
840
}
841
]
842
},
843
{
844
"syscall": "ioctl",
845
"args": [
846
{
847
"index": 1,
848
"type": "dword",
849
"op": "eq",
850
"val": 2156965505,
851
"comment": "KVM_GET_REGS"
852
}
853
]
854
},
855
{
856
"syscall": "ioctl",
857
"args": [
858
{
859
"index": 1,
860
"type": "dword",
861
"op": "eq",
862
"val": 3221794440,
863
"comment": "KVM_GET_MSRS"
864
}
865
]
866
},
867
{
868
"syscall": "ioctl",
869
"args": [
870
{
871
"index": 1,
872
"type": "dword",
873
"op": "eq",
874
"val": 3221794449,
875
"comment": "KVM_GET_CPUID2"
876
}
877
]
878
},
879
{
880
"syscall": "ioctl",
881
"args": [
882
{
883
"index": 1,
884
"type": "dword",
885
"op": "eq",
886
"val": 2155916961,
887
"comment": "KVM_GET_DEBUGREGS"
888
}
889
]
890
},
891
{
892
"syscall": "ioctl",
893
"args": [
894
{
895
"index": 1,
896
"type": "dword",
897
"op": "eq",
898
"val": 1082175138,
899
"comment": "KVM_SET_DEBUGREGS"
900
}
901
]
902
},
903
{
904
"syscall": "ioctl",
905
"args": [
906
{
907
"index": 1,
908
"type": "dword",
909
"op": "eq",
910
"val": 2415963812,
911
"comment": "KVM_GET_XSAVE"
912
}
913
]
914
},
915
{
916
"syscall": "ioctl",
917
"args": [
918
{
919
"index": 1,
920
"type": "dword",
921
"op": "eq",
922
"val": 1342221989,
923
"comment": "KVM_SET_XSAVE"
924
}
925
]
926
},
927
{
928
"syscall": "ioctl",
929
"args": [
930
{
931
"index": 1,
932
"type": "dword",
933
"op": "eq",
934
"val": 2173218470,
935
"comment": "KVM_GET_XCRS"
936
}
937
]
938
},
939
{
940
"syscall": "ioctl",
941
"args": [
942
{
943
"index": 1,
944
"type": "dword",
945
"op": "eq",
946
"val": 1099476647,
947
"comment": "KVM_SET_XCRS"
948
}
949
]
950
},
951
{
952
"syscall": "ioctl",
953
"args": [
954
{
955
"index": 1,
956
"type": "dword",
957
"op": "eq",
958
"val": 44706,
959
"comment": "KVM_SET_TSC_KHZ"
960
}
961
]
962
},
963
{
964
"syscall": "ioctl",
965
"args": [
966
{
967
"index": 1,
968
"type": "dword",
969
"op": "eq",
970
"val": 44707,
971
"comment": "KVM_GET_TSC_KHZ"
972
}
973
]
974
}
975
]
976
}
977
}
978
979