seccomp.toml

# SPDX-License-Identifier: Apache-2.0

# Based on https://github.com/containers/common/blob/2875bdaafdf916815f46e0c3966cdde1ffa6854b/pkg/seccomp/seccomp.json
# Copyright 2013-2018 Docker, Inc.

# See https://github.com/opencontainers/runtime-spec/blob/e935f995dd67c853bd93d6937bab898d36eb1747/config-linux.md#seccomp
# for available keys and their meanings.

defaultAction = "SCMP_ACT_ERRNO"
defaultErrnoRet = 38 # ENOSYS

[[archMap]]
architecture = "SCMP_ARCH_X86_64"
subArchitectures = ["SCMP_ARCH_X86", "SCMP_ARCH_X32"]

[[archMap]]
architecture = "SCMP_ARCH_AARCH64"
subArchitectures = ["SCMP_ARCH_ARM"]

[[archMap]]
architecture = "SCMP_ARCH_MIPS64"
subArchitectures = ["SCMP_ARCH_MIPS", "SCMP_ARCH_MIPS64N32"]

[[archMap]]
architecture = "SCMP_ARCH_MIPS64N32"
subArchitectures = ["SCMP_ARCH_MIPS", "SCMP_ARCH_MIPS64"]

[[archMap]]
architecture = "SCMP_ARCH_MIPSEL64"
subArchitectures = ["SCMP_ARCH_MIPSEL", "SCMP_ARCH_MIPSEL64N32"]

[[archMap]]
architecture = "SCMP_ARCH_MIPSEL64N32"
subArchitectures = ["SCMP_ARCH_MIPSEL", "SCMP_ARCH_MIPSEL64"]

[[archMap]]
architecture = "SCMP_ARCH_S390X"
subArchitectures = ["SCMP_ARCH_S390"]

[[syscalls]]
names = [
    "bdflush",
    "cachestat",
    "futex_requeue",
    "futex_wait",
    "futex_waitv",
    "futex_wake",
    "io_pgetevents",
    "io_pgetevents_time64",
    "kexec_file_load",
    "kexec_load",
    "map_shadow_stack",
    "migrate_pages",
    "move_pages",
    "nfsservctl",
    "nice",
    "oldfstat",
    "oldlstat",
    "oldolduname",
    "oldstat",
    "olduname",
    "pciconfig_iobase",
    "pciconfig_read",
    "pciconfig_write",
    "sgetmask",
    "ssetmask",
    "swapoff",
    "swapon",
    "syscall",
    "sysfs",
    "uselib",
    "userfaultfd",
    "ustat",
    "vm86",
    "vm86old",
    "vmsplice",
]
action = "SCMP_ACT_ERRNO"
errnoRet = 1 # EPERM

[[syscalls]]
names = [
    "_llseek",
    "_newselect",
    "accept",
    "accept4",
    "access",
    "adjtimex",
    "alarm",
    "bind",
    "brk",
    "capget",
    "capset",
    "chdir",
    "chmod",
    "chown",
    "chown32",
    "clock_adjtime",
    "clock_adjtime64",
    "clock_getres",
    "clock_getres_time64",
    "clock_gettime",
    "clock_gettime64",
    "clock_nanosleep",
    "clock_nanosleep_time64",
    "clone",
    "clone3",
    "close",
    "close_range",
    "connect",
    "copy_file_range",
    "creat",
    "dup",
    "dup2",
    "dup3",
    "epoll_create",
    "epoll_create1",
    "epoll_ctl",
    "epoll_ctl_old",
    "epoll_pwait",
    "epoll_pwait2",
    "epoll_wait",
    "epoll_wait_old",
    "eventfd",
    "eventfd2",
    "execve",
    "execveat",
    "exit",
    "exit_group",
    "faccessat",
    "faccessat2",
    "fadvise64",
    "fadvise64_64",
    "fallocate",
    "fanotify_mark",
    "fchdir",
    "fchmod",
    "fchmodat",
    "fchmodat2",
    "fchown",
    "fchown32",
    "fchownat",
    "fcntl",
    "fcntl64",
    "fdatasync",
    "fgetxattr",
    "flistxattr",
    "flock",
    "fork",
    "fremovexattr",
    "fsconfig",
    "fsetxattr",
    "fsmount",
    "fsopen",
    "fspick",
    "fstat",
    "fstat64",
    "fstatat64",
    "fstatfs",
    "fstatfs64",
    "fsync",
    "ftruncate",
    "ftruncate64",
    "futex",
    "futex_time64",
    "futimesat",
    "get_mempolicy",
    "get_robust_list",
    "get_thread_area",
    "getcpu",
    "getcwd",
    "getdents",
    "getdents64",
    "getegid",
    "getegid32",
    "geteuid",
    "geteuid32",
    "getgid",
    "getgid32",
    "getgroups",
    "getgroups32",
    "getitimer",
    "getpeername",
    "getpgid",
    "getpgrp",
    "getpid",
    "getppid",
    "getpriority",
    "getrandom",
    "getresgid",
    "getresgid32",
    "getresuid",
    "getresuid32",
    "getrlimit",
    "getrusage",
    "getsid",
    "getsockname",
    "getsockopt",
    "gettid",
    "gettimeofday",
    "getuid",
    "getuid32",
    "getxattr",
    "inotify_add_watch",
    "inotify_init",
    "inotify_init1",
    "inotify_rm_watch",
    "io_cancel",
    "io_destroy",
    "io_getevents",
    "io_setup",
    "io_submit",
    "ioctl",
    "ioprio_get",
    "ioprio_set",
    "ipc",
    "keyctl",
    "kill",
    "landlock_add_rule",
    "landlock_create_ruleset",
    "landlock_restrict_self",
    "lchown",
    "lchown32",
    "lgetxattr",
    "link",
    "linkat",
    "listen",
    "listxattr",
    "llistxattr",
    "lremovexattr",
    "lseek",
    "lsetxattr",
    "lstat",
    "lstat64",
    "madvise",
    "mbind",
    "membarrier",
    "memfd_create",
    "memfd_secret",
    "mincore",
    "mkdir",
    "mkdirat",
    "mknod",
    "mknodat",
    "mlock",
    "mlock2",
    "mlockall",
    "mmap",
    "mmap2",
    "mount",
    "mount_setattr",
    "move_mount",
    "mprotect",
    "mq_getsetattr",
    "mq_notify",
    "mq_open",
    "mq_timedreceive",
    "mq_timedreceive_time64",
    "mq_timedsend",
    "mq_timedsend_time64",
    "mq_unlink",
    "mremap",
    "msgctl",
    "msgget",
    "msgrcv",
    "msgsnd",
    "msync",
    "munlock",
    "munlockall",
    "munmap",
    "name_to_handle_at",
    "nanosleep",
    "newfstatat",
    "open",
    "open_tree",
    "openat",
    "openat2",
    "pause",
    "pidfd_getfd",
    "pidfd_open",
    "pidfd_send_signal",
    "pipe",
    "pipe2",
    "pivot_root",
    "pkey_alloc",
    "pkey_free",
    "pkey_mprotect",
    "poll",
    "ppoll",
    "ppoll_time64",
    "prctl",
    "pread64",
    "preadv",
    "preadv2",
    "prlimit64",
    "process_mrelease",
    "process_vm_readv",
    "process_vm_writev",
    "pselect6",
    "pselect6_time64",
    "ptrace",
    "pwrite64",
    "pwritev",
    "pwritev2",
    "read",
    "readahead",
    "readlink",
    "readlinkat",
    "readv",
    "reboot",
    "recv",
    "recvfrom",
    "recvmmsg",
    "recvmmsg_time64",
    "recvmsg",
    "remap_file_pages",
    "removexattr",
    "rename",
    "renameat",
    "renameat2",
    "restart_syscall",
    "rmdir",
    "rseq",
    "rt_sigaction",
    "rt_sigpending",
    "rt_sigprocmask",
    "rt_sigqueueinfo",
    "rt_sigreturn",
    "rt_sigsuspend",
    "rt_sigtimedwait",
    "rt_sigtimedwait_time64",
    "rt_tgsigqueueinfo",
    "sched_get_priority_max",
    "sched_get_priority_min",
    "sched_getaffinity",
    "sched_getattr",
    "sched_getparam",
    "sched_getscheduler",
    "sched_rr_get_interval",
    "sched_rr_get_interval_time64",
    "sched_setaffinity",
    "sched_setattr",
    "sched_setparam",
    "sched_setscheduler",
    "sched_yield",
    "seccomp",
    "select",
    "semctl",
    "semget",
    "semop",
    "semtimedop",
    "semtimedop_time64",
    "send",
    "sendfile",
    "sendfile64",
    "sendmmsg",
    "sendmsg",
    "sendto",
    "set_mempolicy",
    "set_robust_list",
    "set_thread_area",
    "set_tid_address",
    "setfsgid",
    "setfsgid32",
    "setfsuid",
    "setfsuid32",
    "setgid",
    "setgid32",
    "setgroups",
    "setgroups32",
    "setitimer",
    "setns",
    "setpgid",
    "setpriority",
    "setregid",
    "setregid32",
    "setresgid",
    "setresgid32",
    "setresuid",
    "setresuid32",
    "setreuid",
    "setreuid32",
    "setrlimit",
    "setsid",
    "setsockopt",
    "setuid",
    "setuid32",
    "setxattr",
    "shmat",
    "shmctl",
    "shmdt",
    "shmget",
    "shutdown",
    "sigaltstack",
    "signal",
    "signalfd",
    "signalfd4",
    "sigprocmask",
    "sigreturn",
    "socketcall",
    "socketpair",
    "splice",
    "stat",
    "stat64",
    "statfs",
    "statfs64",
    "statx",
    "symlink",
    "symlinkat",
    "sync",
    "sync_file_range",
    "syncfs",
    "sysinfo",
    "syslog",
    "tee",
    "tgkill",
    "time",
    "timer_create",
    "timer_delete",
    "timer_getoverrun",
    "timer_gettime",
    "timer_gettime64",
    "timer_settime",
    "timer_settime64",
    "timerfd_create",
    "timerfd_gettime",
    "timerfd_gettime64",
    "timerfd_settime",
    "timerfd_settime64",
    "times",
    "tkill",
    "truncate",
    "truncate64",
    "ugetrlimit",
    "umask",
    "umount",
    "umount2",
    "uname",
    "unlink",
    "unlinkat",
    "unshare",
    "utime",
    "utimensat",
    "utimensat_time64",
    "utimes",
    "vfork",
    "wait4",
    "waitid",
    "waitpid",
    "write",
    "writev",
]
action = "SCMP_ACT_ALLOW"

[[syscalls]]
names = ["personality"]
action = "SCMP_ACT_ALLOW"

[[syscalls.args]]
index = 0
value = 0
valueTwo = 0
op = "SCMP_CMP_EQ"

[[syscalls]]
names = ["personality"]
action = "SCMP_ACT_ALLOW"

[[syscalls.args]]
index = 0
value = 8
valueTwo = 0
op = "SCMP_CMP_EQ"

[[syscalls]]
names = ["personality"]
action = "SCMP_ACT_ALLOW"

[[syscalls.args]]
index = 0
value = 131072
valueTwo = 0
op = "SCMP_CMP_EQ"

[[syscalls]]
names = ["personality"]
action = "SCMP_ACT_ALLOW"

[[syscalls.args]]
index = 0
value = 131080
valueTwo = 0
op = "SCMP_CMP_EQ"

[[syscalls]]
names = ["personality"]
action = "SCMP_ACT_ALLOW"

[[syscalls.args]]
index = 0
value = 4294967295
valueTwo = 0
op = "SCMP_CMP_EQ"

[[syscalls]]
names = ["sync_file_range2", "swapcontext"]
action = "SCMP_ACT_ALLOW"
[syscalls.includes]
arches = ["ppc64le"]

[[syscalls]]
names = [
    "arm_fadvise64_64",
    "arm_sync_file_range",
    "breakpoint",
    "cacheflush",
    "set_tls",
    "sync_file_range2",
]
action = "SCMP_ACT_ALLOW"
[syscalls.includes]
arches = ["arm", "arm64"]

[[syscalls]]
names = ["arch_prctl"]
action = "SCMP_ACT_ALLOW"
[syscalls.includes]
arches = ["amd64", "x32"]

[[syscalls]]
names = ["modify_ldt"]
action = "SCMP_ACT_ALLOW"
[syscalls.includes]
arches = ["amd64", "x32", "x86"]

[[syscalls]]
names = ["s390_pci_mmio_read", "s390_pci_mmio_write", "s390_runtime_instr"]
action = "SCMP_ACT_ALLOW"
[syscalls.includes]
arches = ["s390", "s390x"]

[[syscalls]]
names = ["riscv_flush_icache"]
action = "SCMP_ACT_ALLOW"
[syscalls.includes]
arches = ["riscv64"]

[[syscalls]]
names = ["open_by_handle_at"]
action = "SCMP_ACT_ALLOW"
[syscalls.includes]
caps = ["CAP_DAC_READ_SEARCH"]

[[syscalls]]
names = ["open_by_handle_at"]
action = "SCMP_ACT_ERRNO"
errnoRet = 1 # EPERM
[syscalls.excludes]
caps = ["CAP_DAC_READ_SEARCH"]

[[syscalls]]
names = [
    "bpf",
    "fanotify_init",
    "lookup_dcookie",
    "quotactl",
    "quotactl_fd",
    "setdomainname",
    "sethostname",
    "setns",
]
action = "SCMP_ACT_ALLOW"
[syscalls.includes]
caps = ["CAP_SYS_ADMIN"]

[[syscalls]]
names = [
    "fanotify_init",
    "lookup_dcookie",
    "perf_event_open",
    "quotactl",
    "quotactl_fd",
    "setdomainname",
    "sethostname",
    "setns",
]
action = "SCMP_ACT_ERRNO"
errnoRet = 1 # EPERM
[syscalls.excludes]
caps = ["CAP_SYS_ADMIN"]

[[syscalls]]
names = ["chroot"]
action = "SCMP_ACT_ALLOW"
[syscalls.includes]
caps = ["CAP_SYS_CHROOT"]

[[syscalls]]
names = ["chroot"]
action = "SCMP_ACT_ERRNO"
errnoRet = 1 # EPERM
[syscalls.excludes]
caps = ["CAP_SYS_CHROOT"]

[[syscalls]]
names = ["delete_module", "finit_module", "init_module", "query_module"]
action = "SCMP_ACT_ALLOW"
[syscalls.includes]
caps = ["CAP_SYS_MODULE"]

[[syscalls]]
names = ["delete_module", "finit_module", "init_module", "query_module"]
action = "SCMP_ACT_ERRNO"
errnoRet = 1 # EPERM
[syscalls.excludes]
caps = ["CAP_SYS_MODULE"]

[[syscalls]]
names = ["acct"]
action = "SCMP_ACT_ALLOW"
[syscalls.includes]
caps = ["CAP_SYS_PACCT"]

[[syscalls]]
names = ["acct"]
action = "SCMP_ACT_ERRNO"
errnoRet = 1 # EPERM
[syscalls.excludes]
caps = ["CAP_SYS_PACCT"]

[[syscalls]]
names = ["kcmp", "process_madvise"]
action = "SCMP_ACT_ALLOW"
[syscalls.includes]
caps = ["CAP_SYS_PTRACE"]

[[syscalls]]
names = ["kcmp", "process_madvise"]
action = "SCMP_ACT_ERRNO"
errnoRet = 1 # EPERM
[syscalls.excludes]
caps = ["CAP_SYS_PTRACE"]

[[syscalls]]
names = ["ioperm", "iopl"]
action = "SCMP_ACT_ALLOW"
[syscalls.includes]
caps = ["CAP_SYS_RAWIO"]

[[syscalls]]
names = ["ioperm", "iopl"]
action = "SCMP_ACT_ERRNO"
errnoRet = 1 # EPERM
[syscalls.excludes]
caps = ["CAP_SYS_RAWIO"]

[[syscalls]]
names = ["clock_settime", "clock_settime64", "settimeofday", "stime"]
action = "SCMP_ACT_ALLOW"
[syscalls.includes]
caps = ["CAP_SYS_TIME"]

[[syscalls]]
names = ["clock_settime", "clock_settime64", "settimeofday", "stime"]
action = "SCMP_ACT_ERRNO"
errnoRet = 1 # EPERM
[syscalls.excludes]
caps = ["CAP_SYS_TIME"]

[[syscalls]]
names = ["vhangup"]
action = "SCMP_ACT_ALLOW"
[syscalls.includes]
caps = ["CAP_SYS_TTY_CONFIG"]

[[syscalls]]
names = ["vhangup"]
action = "SCMP_ACT_ERRNO"
errnoRet = 1 # EPERM
[syscalls.excludes]
caps = ["CAP_SYS_TTY_CONFIG"]

[[syscalls]]
names = ["socket"]
action = "SCMP_ACT_ERRNO"
errnoRet = 22 # EINVAL

[[syscalls.args]]
index = 0
value = 16
valueTwo = 0
op = "SCMP_CMP_EQ"

[[syscalls.args]]
index = 2
value = 9
valueTwo = 0
op = "SCMP_CMP_EQ"
[syscalls.excludes]
caps = ["CAP_AUDIT_WRITE"]

[[syscalls]]
names = ["socket"]
action = "SCMP_ACT_ALLOW"

[[syscalls.args]]
index = 2
value = 9
valueTwo = 0
op = "SCMP_CMP_NE"
[syscalls.excludes]
caps = ["CAP_AUDIT_WRITE"]

[[syscalls]]
names = ["socket"]
action = "SCMP_ACT_ALLOW"

[[syscalls.args]]
index = 0
value = 16
valueTwo = 0
op = "SCMP_CMP_NE"
[syscalls.excludes]
caps = ["CAP_AUDIT_WRITE"]

[[syscalls]]
names = ["socket"]
action = "SCMP_ACT_ALLOW"

[[syscalls.args]]
index = 2
value = 9
valueTwo = 0
op = "SCMP_CMP_NE"
[syscalls.excludes]
caps = ["CAP_AUDIT_WRITE"]

[[syscalls]]
names = ["socket"]
action = "SCMP_ACT_ALLOW"
[syscalls.includes]
caps = ["CAP_AUDIT_WRITE"]

[[syscalls]]
names = ["bpf"]
action = "SCMP_ACT_ERRNO"
errnoRet = 1 # EPERM
[syscalls.excludes]
caps = ["CAP_SYS_ADMIN", "CAP_BPF"]

[[syscalls]]
names = ["bpf"]
action = "SCMP_ACT_ALLOW"
[syscalls.includes]
caps = ["CAP_BPF"]

[[syscalls]]
names = ["perf_event_open"]
action = "SCMP_ACT_ERRNO"
errnoRet = 1 # EPERM
[syscalls.excludes]
caps = ["CAP_SYS_ADMIN", "CAP_BPF"]

[[syscalls]]
names = ["perf_event_open"]
action = "SCMP_ACT_ALLOW"
[syscalls.includes]
caps = ["CAP_PERFMON"]