profiles/heimdall-wasm-host/x86_64-glibc.rs
// SPDX-License-Identifier: MIT-0
// This file is generated output of Heimdall (`heimdall profile gen`): data about the profiled
// program, not covered by Heimdall's AGPL. Use it under any licence, including the program's own.
// GENERATED by heimdall-probe (`heimdall profile gen heimdall-wasm-host`). Do not edit by hand:
// probe, regenerate and review the diff (spec §3.1). Heimdall is a defensive sandbox;
// this is the whole syscall allowlist of `heimdall-wasm-host` on x86_64 glibc.
//
// probed with 27 run(s): a_guest_with_a_wrong_signature_is_not_loaded, deep_recursion_overflows_the_stack, good_input_is_accepted, infinite_loop_hits_the_wall_clock, infinite_loop_runs_out_of_fuel, malformed_input_traps_the_guest, many_files_hit_the_file_count_limit, memory_bomb_hits_the_memory_limit, tampered_input_is_refused, verify_bundle_single_bomb_lying_is_refused, verify_bundle_single_bomb_ratio_is_refused, verify_bundle_single_manychunk_is_accepted, verify_bundle_single_openzl_is_accepted, verify_bundle_single_stored_is_accepted, verify_bundle_single_tampered_is_refused, verify_bundle_split_n1_bomb_lying_is_refused, verify_bundle_split_n1_bomb_ratio_is_refused, verify_bundle_split_n1_manychunk_is_accepted, verify_bundle_split_n1_openzl_is_accepted, verify_bundle_split_n1_stored_is_accepted, verify_bundle_split_n1_tampered_is_refused, verify_bundle_split_n8_bomb_lying_is_refused, verify_bundle_split_n8_bomb_ratio_is_refused, verify_bundle_split_n8_manychunk_is_accepted, verify_bundle_split_n8_openzl_is_accepted, verify_bundle_split_n8_stored_is_accepted, verify_bundle_split_n8_tampered_is_refused
//
// near-miss, seen only on error paths:
// rt_sigreturn (by deep_recursion_overflows_the_stack, malformed_input_traps_the_guest)
//
// fixed rules:
// clone3: errno 38 (answered by the probe in learning mode too)
//
// notes:
// clock_gettime, clock_getres, gettimeofday, time and getcpu normally run in the vDSO and never reach seccomp; their syscall fallbacks are in the profile only if the probe saw them
/// The seccomp profile of `heimdall-wasm-host` on x86_64 glibc.
pub const PROFILE: heimdall_seccomp::StaticProfile = heimdall_seccomp::StaticProfile {
workload: "heimdall-wasm-host",
arch: heimdall_seccomp::Arch::X86_64,
libc: heimdall_seccomp::Libc::Glibc,
rules: &[
heimdall_seccomp::StaticRule {
syscall: "access",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "arch_prctl",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "brk",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "clock_nanosleep",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "clone",
action: heimdall_seccomp::Action::Allow,
when: &[
&[
heimdall_seccomp::ArgCmp { arg: 0, width: heimdall_seccomp::Width::W64, mask: 0xffffffffffc2f0ff, value: 0x0 },
],
],
},
heimdall_seccomp::StaticRule {
syscall: "clone3",
action: heimdall_seccomp::Action::Errno(38),
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "close",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "exit",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "exit_group",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "fstat",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "fsync",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "futex",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "getdents64",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "getrandom",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "gettid",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "lseek",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "madvise",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "mkdir",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "mmap",
action: heimdall_seccomp::Action::Allow,
when: &[
&[
heimdall_seccomp::ArgCmp { arg: 2, width: heimdall_seccomp::Width::W32, mask: 0xffffffff, value: 0x0 },
],
&[
heimdall_seccomp::ArgCmp { arg: 2, width: heimdall_seccomp::Width::W32, mask: 0xffffffff, value: 0x1 },
],
&[
heimdall_seccomp::ArgCmp { arg: 2, width: heimdall_seccomp::Width::W32, mask: 0xffffffff, value: 0x3 },
],
&[
heimdall_seccomp::ArgCmp { arg: 2, width: heimdall_seccomp::Width::W32, mask: 0xffffffff, value: 0x5 },
],
],
},
heimdall_seccomp::StaticRule {
syscall: "mprotect",
action: heimdall_seccomp::Action::Allow,
when: &[
&[
heimdall_seccomp::ArgCmp { arg: 2, width: heimdall_seccomp::Width::W32, mask: 0xffffffff, value: 0x0 },
],
&[
heimdall_seccomp::ArgCmp { arg: 2, width: heimdall_seccomp::Width::W32, mask: 0xffffffff, value: 0x1 },
],
&[
heimdall_seccomp::ArgCmp { arg: 2, width: heimdall_seccomp::Width::W32, mask: 0xffffffff, value: 0x3 },
],
&[
heimdall_seccomp::ArgCmp { arg: 2, width: heimdall_seccomp::Width::W32, mask: 0xffffffff, value: 0x5 },
],
],
},
heimdall_seccomp::StaticRule {
syscall: "mremap",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "munmap",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "openat",
action: heimdall_seccomp::Action::Allow,
when: &[
&[
heimdall_seccomp::ArgCmp { arg: 2, width: heimdall_seccomp::Width::W32, mask: 0xfff4f73e, value: 0x0 },
],
],
},
heimdall_seccomp::StaticRule {
syscall: "poll",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "prctl",
action: heimdall_seccomp::Action::Allow,
when: &[
&[
heimdall_seccomp::ArgCmp { arg: 0, width: heimdall_seccomp::Width::W32, mask: 0xffffffff, value: 0xf },
],
],
},
heimdall_seccomp::StaticRule {
syscall: "pread64",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "prlimit64",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "read",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "rseq",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "rt_sigaction",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "rt_sigprocmask",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "rt_sigreturn",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "sched_getaffinity",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "sched_yield",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "set_robust_list",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "set_tid_address",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "sigaltstack",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "statx",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "write",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
],
};