server/sandbox/seccomp/clamd/x86_64-musl.json
{
"workload": "clamd",
"arch": "x86_64",
"libc": "musl",
"rules": [
{
"syscall": "accept",
"action": "allow"
},
{
"syscall": "access",
"action": "allow"
},
{
"syscall": "arch_prctl",
"action": "allow"
},
{
"syscall": "bind",
"action": "allow"
},
{
"syscall": "brk",
"action": "allow"
},
{
"syscall": "chmod",
"action": "allow"
},
{
"syscall": "clock_gettime",
"action": "allow"
},
{
"syscall": "clone",
"action": "allow",
"when": [
[
{
"arg": 0,
"width": "w64",
"mask": "0xffffffffff82f0ff",
"value": "0x0"
}
]
]
},
{
"syscall": "clone3",
"action": {
"errno": 38
}
},
{
"syscall": "close",
"action": "allow"
},
{
"syscall": "dup",
"action": "allow"
},
{
"syscall": "exit",
"action": "allow"
},
{
"syscall": "exit_group",
"action": "allow"
},
{
"syscall": "fcntl",
"action": "allow",
"when": [
[
{
"arg": 1,
"width": "w32",
"mask": "0xffffffff",
"value": "0x2"
}
],
[
{
"arg": 1,
"width": "w32",
"mask": "0xffffffff",
"value": "0x3"
}
],
[
{
"arg": 1,
"width": "w32",
"mask": "0xffffffff",
"value": "0x4"
}
]
]
},
{
"syscall": "fstat",
"action": "allow"
},
{
"syscall": "ftruncate",
"action": "allow"
},
{
"syscall": "futex",
"action": "allow"
},
{
"syscall": "getdents64",
"action": "allow"
},
{
"syscall": "getegid",
"action": "allow"
},
{
"syscall": "geteuid",
"action": "allow"
},
{
"syscall": "getgid",
"action": "allow"
},
{
"syscall": "getpeername",
"action": "allow"
},
{
"syscall": "getpid",
"action": "allow"
},
{
"syscall": "getrandom",
"action": "allow"
},
{
"syscall": "getuid",
"action": "allow"
},
{
"syscall": "ioctl",
"action": "allow",
"when": [
[
{
"arg": 1,
"width": "w32",
"mask": "0xffffffff",
"value": "0x5413"
}
]
]
},
{
"syscall": "listen",
"action": "allow"
},
{
"syscall": "lseek",
"action": "allow"
},
{
"syscall": "lstat",
"action": "allow"
},
{
"syscall": "membarrier",
"action": "allow"
},
{
"syscall": "mkdir",
"action": "allow"
},
{
"syscall": "mmap",
"action": "allow",
"when": [
[
{
"arg": 2,
"width": "w32",
"mask": "0xffffffff",
"value": "0x0"
}
],
[
{
"arg": 2,
"width": "w32",
"mask": "0xffffffff",
"value": "0x1"
}
],
[
{
"arg": 2,
"width": "w32",
"mask": "0xffffffff",
"value": "0x3"
}
],
[
{
"arg": 2,
"width": "w32",
"mask": "0xffffffff",
"value": "0x5"
}
]
]
},
{
"syscall": "mprotect",
"action": "allow",
"when": [
[
{
"arg": 2,
"width": "w32",
"mask": "0xffffffff",
"value": "0x1"
}
],
[
{
"arg": 2,
"width": "w32",
"mask": "0xffffffff",
"value": "0x3"
}
]
]
},
{
"syscall": "mremap",
"action": "allow"
},
{
"syscall": "munmap",
"action": "allow"
},
{
"syscall": "open",
"action": "allow",
"when": [
[
{
"arg": 1,
"width": "w32",
"mask": "0xfff6753c",
"value": "0x0"
}
]
]
},
{
"syscall": "pipe",
"action": "allow"
},
{
"syscall": "poll",
"action": "allow"
},
{
"syscall": "pread64",
"action": "allow"
},
{
"syscall": "prlimit64",
"action": "allow"
},
{
"syscall": "read",
"action": "allow"
},
{
"syscall": "readlink",
"action": "allow"
},
{
"syscall": "readv",
"action": "allow"
},
{
"syscall": "recvmsg",
"action": "allow"
},
{
"syscall": "rmdir",
"action": "allow"
},
{
"syscall": "rt_sigaction",
"action": "allow"
},
{
"syscall": "rt_sigprocmask",
"action": "allow"
},
{
"syscall": "rt_sigreturn",
"action": "allow"
},
{
"syscall": "sendto",
"action": "allow"
},
{
"syscall": "set_tid_address",
"action": "allow"
},
{
"syscall": "shutdown",
"action": "allow"
},
{
"syscall": "socket",
"action": "allow",
"when": [
[
{
"arg": 0,
"width": "w32",
"mask": "0xffffffff",
"value": "0x1"
},
{
"arg": 1,
"width": "w32",
"mask": "0xffffffff",
"value": "0x1"
},
{
"arg": 2,
"width": "w32",
"mask": "0xffffffff",
"value": "0x0"
}
]
]
},
{
"syscall": "stat",
"action": "allow"
},
{
"syscall": "umask",
"action": "allow"
},
{
"syscall": "uname",
"action": "allow"
},
{
"syscall": "unlink",
"action": "allow"
},
{
"syscall": "write",
"action": "allow"
},
{
"syscall": "writev",
"action": "allow"
}
],
"review": {
"runs": [
"clamd_runs_long",
"clamd_serves_holger",
"clamd_survives_bad_clients"
],
"near_miss": [],
"wx": [],
"bare": [],
"unknown": [],
"fixed": [
"clone3: errno 38 (answered by the probe in learning mode too)"
],
"notes": [
"clock_gettime, clock_getres, gettimeofday, time and getcpu normally run in the vDSO and never reach seccomp; their syscall fallbacks are in the profile only if the probe saw them"
]
}
}