profiles/heimdall-wasm-host/x86_64-glibc.json
{
"workload": "heimdall-wasm-host",
"arch": "x86_64",
"libc": "glibc",
"rules": [
{
"syscall": "access",
"action": "allow"
},
{
"syscall": "arch_prctl",
"action": "allow"
},
{
"syscall": "brk",
"action": "allow"
},
{
"syscall": "clock_nanosleep",
"action": "allow"
},
{
"syscall": "clone",
"action": "allow",
"when": [
[
{
"arg": 0,
"width": "w64",
"mask": "0xffffffffffc2f0ff",
"value": "0x0"
}
]
]
},
{
"syscall": "clone3",
"action": {
"errno": 38
}
},
{
"syscall": "close",
"action": "allow"
},
{
"syscall": "exit",
"action": "allow"
},
{
"syscall": "exit_group",
"action": "allow"
},
{
"syscall": "fstat",
"action": "allow"
},
{
"syscall": "fsync",
"action": "allow"
},
{
"syscall": "futex",
"action": "allow"
},
{
"syscall": "getdents64",
"action": "allow"
},
{
"syscall": "getrandom",
"action": "allow"
},
{
"syscall": "gettid",
"action": "allow"
},
{
"syscall": "lseek",
"action": "allow"
},
{
"syscall": "madvise",
"action": "allow"
},
{
"syscall": "mkdir",
"action": "allow"
},
{
"syscall": "mmap",
"action": "allow",
"when": [
[
{
"arg": 2,
"width": "w32",
"mask": "0xffffffff",
"value": "0x0"
}
],
[
{
"arg": 2,
"width": "w32",
"mask": "0xffffffff",
"value": "0x1"
}
],
[
{
"arg": 2,
"width": "w32",
"mask": "0xffffffff",
"value": "0x3"
}
],
[
{
"arg": 2,
"width": "w32",
"mask": "0xffffffff",
"value": "0x5"
}
]
]
},
{
"syscall": "mprotect",
"action": "allow",
"when": [
[
{
"arg": 2,
"width": "w32",
"mask": "0xffffffff",
"value": "0x0"
}
],
[
{
"arg": 2,
"width": "w32",
"mask": "0xffffffff",
"value": "0x1"
}
],
[
{
"arg": 2,
"width": "w32",
"mask": "0xffffffff",
"value": "0x3"
}
],
[
{
"arg": 2,
"width": "w32",
"mask": "0xffffffff",
"value": "0x5"
}
]
]
},
{
"syscall": "mremap",
"action": "allow"
},
{
"syscall": "munmap",
"action": "allow"
},
{
"syscall": "openat",
"action": "allow",
"when": [
[
{
"arg": 2,
"width": "w32",
"mask": "0xfff4f73e",
"value": "0x0"
}
]
]
},
{
"syscall": "poll",
"action": "allow"
},
{
"syscall": "prctl",
"action": "allow",
"when": [
[
{
"arg": 0,
"width": "w32",
"mask": "0xffffffff",
"value": "0xf"
}
]
]
},
{
"syscall": "pread64",
"action": "allow"
},
{
"syscall": "prlimit64",
"action": "allow"
},
{
"syscall": "read",
"action": "allow"
},
{
"syscall": "rseq",
"action": "allow"
},
{
"syscall": "rt_sigaction",
"action": "allow"
},
{
"syscall": "rt_sigprocmask",
"action": "allow"
},
{
"syscall": "rt_sigreturn",
"action": "allow"
},
{
"syscall": "sched_getaffinity",
"action": "allow"
},
{
"syscall": "sched_yield",
"action": "allow"
},
{
"syscall": "set_robust_list",
"action": "allow"
},
{
"syscall": "set_tid_address",
"action": "allow"
},
{
"syscall": "sigaltstack",
"action": "allow"
},
{
"syscall": "statx",
"action": "allow"
},
{
"syscall": "write",
"action": "allow"
}
],
"review": {
"runs": [
"a_guest_with_a_wrong_signature_is_not_loaded",
"deep_recursion_overflows_the_stack",
"good_input_is_accepted",
"infinite_loop_hits_the_wall_clock",
"infinite_loop_runs_out_of_fuel",
"malformed_input_traps_the_guest",
"many_files_hit_the_file_count_limit",
"memory_bomb_hits_the_memory_limit",
"tampered_input_is_refused",
"verify_bundle_single_bomb_lying_is_refused",
"verify_bundle_single_bomb_ratio_is_refused",
"verify_bundle_single_manychunk_is_accepted",
"verify_bundle_single_openzl_is_accepted",
"verify_bundle_single_stored_is_accepted",
"verify_bundle_single_tampered_is_refused",
"verify_bundle_split_n1_bomb_lying_is_refused",
"verify_bundle_split_n1_bomb_ratio_is_refused",
"verify_bundle_split_n1_manychunk_is_accepted",
"verify_bundle_split_n1_openzl_is_accepted",
"verify_bundle_split_n1_stored_is_accepted",
"verify_bundle_split_n1_tampered_is_refused",
"verify_bundle_split_n8_bomb_lying_is_refused",
"verify_bundle_split_n8_bomb_ratio_is_refused",
"verify_bundle_split_n8_manychunk_is_accepted",
"verify_bundle_split_n8_openzl_is_accepted",
"verify_bundle_split_n8_stored_is_accepted",
"verify_bundle_split_n8_tampered_is_refused"
],
"near_miss": [
{
"call": "rt_sigreturn",
"runs": [
"deep_recursion_overflows_the_stack",
"malformed_input_traps_the_guest"
]
}
],
"wx": [],
"bare": [],
"unknown": [],
"fixed": [
"clone3: errno 38 (answered by the probe in learning mode too)"
],
"notes": [
"clock_gettime, clock_getres, gettimeofday, time and getcpu normally run in the vDSO and never reach seccomp; their syscall fallbacks are in the profile only if the probe saw them"
]
}
}