server/sandbox/seccomp/clamd/x86_64-musl.rs
// SPDX-License-Identifier: MIT-0
// This file is generated output of Heimdall (`heimdall profile gen`): data about the profiled
// program, not covered by Heimdall's AGPL. Use it under any licence, including the program's own.
// GENERATED by heimdall-probe (`heimdall profile gen clamd`). Do not edit by hand:
// probe, regenerate and review the diff (spec §3.1). Heimdall is a defensive sandbox;
// this is the whole syscall allowlist of `clamd` on x86_64 musl.
//
// probed with 3 run(s): clamd_runs_long, clamd_serves_holger, clamd_survives_bad_clients
//
// fixed rules:
// clone3: errno 38 (answered by the probe in learning mode too)
//
// notes:
// clock_gettime, clock_getres, gettimeofday, time and getcpu normally run in the vDSO and never reach seccomp; their syscall fallbacks are in the profile only if the probe saw them
/// The seccomp profile of `clamd` on x86_64 musl.
pub const PROFILE: heimdall_seccomp::StaticProfile = heimdall_seccomp::StaticProfile {
workload: "clamd",
arch: heimdall_seccomp::Arch::X86_64,
libc: heimdall_seccomp::Libc::Musl,
rules: &[
heimdall_seccomp::StaticRule {
syscall: "accept",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "access",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "arch_prctl",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "bind",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "brk",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "chmod",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "clock_gettime",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "clone",
action: heimdall_seccomp::Action::Allow,
when: &[
&[
heimdall_seccomp::ArgCmp { arg: 0, width: heimdall_seccomp::Width::W64, mask: 0xffffffffff82f0ff, value: 0x0 },
],
],
},
heimdall_seccomp::StaticRule {
syscall: "clone3",
action: heimdall_seccomp::Action::Errno(38),
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "close",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "dup",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "exit",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "exit_group",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "fcntl",
action: heimdall_seccomp::Action::Allow,
when: &[
&[
heimdall_seccomp::ArgCmp { arg: 1, width: heimdall_seccomp::Width::W32, mask: 0xffffffff, value: 0x2 },
],
&[
heimdall_seccomp::ArgCmp { arg: 1, width: heimdall_seccomp::Width::W32, mask: 0xffffffff, value: 0x3 },
],
&[
heimdall_seccomp::ArgCmp { arg: 1, width: heimdall_seccomp::Width::W32, mask: 0xffffffff, value: 0x4 },
],
],
},
heimdall_seccomp::StaticRule {
syscall: "fstat",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "ftruncate",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "futex",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "getdents64",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "getegid",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "geteuid",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "getgid",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "getpeername",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "getpid",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "getrandom",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "getuid",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "ioctl",
action: heimdall_seccomp::Action::Allow,
when: &[
&[
heimdall_seccomp::ArgCmp { arg: 1, width: heimdall_seccomp::Width::W32, mask: 0xffffffff, value: 0x5413 },
],
],
},
heimdall_seccomp::StaticRule {
syscall: "listen",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "lseek",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "lstat",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "membarrier",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "mkdir",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "mmap",
action: heimdall_seccomp::Action::Allow,
when: &[
&[
heimdall_seccomp::ArgCmp { arg: 2, width: heimdall_seccomp::Width::W32, mask: 0xffffffff, value: 0x0 },
],
&[
heimdall_seccomp::ArgCmp { arg: 2, width: heimdall_seccomp::Width::W32, mask: 0xffffffff, value: 0x1 },
],
&[
heimdall_seccomp::ArgCmp { arg: 2, width: heimdall_seccomp::Width::W32, mask: 0xffffffff, value: 0x3 },
],
&[
heimdall_seccomp::ArgCmp { arg: 2, width: heimdall_seccomp::Width::W32, mask: 0xffffffff, value: 0x5 },
],
],
},
heimdall_seccomp::StaticRule {
syscall: "mprotect",
action: heimdall_seccomp::Action::Allow,
when: &[
&[
heimdall_seccomp::ArgCmp { arg: 2, width: heimdall_seccomp::Width::W32, mask: 0xffffffff, value: 0x1 },
],
&[
heimdall_seccomp::ArgCmp { arg: 2, width: heimdall_seccomp::Width::W32, mask: 0xffffffff, value: 0x3 },
],
],
},
heimdall_seccomp::StaticRule {
syscall: "mremap",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "munmap",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "open",
action: heimdall_seccomp::Action::Allow,
when: &[
&[
heimdall_seccomp::ArgCmp { arg: 1, width: heimdall_seccomp::Width::W32, mask: 0xfff6753c, value: 0x0 },
],
],
},
heimdall_seccomp::StaticRule {
syscall: "pipe",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "poll",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "pread64",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "prlimit64",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "read",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "readlink",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "readv",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "recvmsg",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "rmdir",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "rt_sigaction",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "rt_sigprocmask",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "rt_sigreturn",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "sendto",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "set_tid_address",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "shutdown",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "socket",
action: heimdall_seccomp::Action::Allow,
when: &[
&[
heimdall_seccomp::ArgCmp { arg: 0, width: heimdall_seccomp::Width::W32, mask: 0xffffffff, value: 0x1 },
heimdall_seccomp::ArgCmp { arg: 1, width: heimdall_seccomp::Width::W32, mask: 0xffffffff, value: 0x1 },
heimdall_seccomp::ArgCmp { arg: 2, width: heimdall_seccomp::Width::W32, mask: 0xffffffff, value: 0x0 },
],
],
},
heimdall_seccomp::StaticRule {
syscall: "stat",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "umask",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "uname",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "unlink",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "write",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
heimdall_seccomp::StaticRule {
syscall: "writev",
action: heimdall_seccomp::Action::Allow,
when: &[],
},
],
};