1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
|
Hints for writing seccomp.drop lines
====================================
Definition of groups
--------------------
@clock=adjtimex,clock_adjtime,clock_settime,settimeofday,stime
@module=delete_module,finit_module,init_module
@raw-io=ioperm,iopl,pciconfig_iobase,pciconfig_read,pciconfig_write,s390_mmio_read,s390_mmio_write
@reboot=kexec_file_load,kexec_load,reboot
@swap=swapoff,swapon
@privileged=@clock,@module,@raw-io,@reboot,@swap,acct,bpf,chroot,mount,nfsservctl,pivot_root,setdomainname,sethostname,umount2,vhangup
@cpu-emulation=modify_ldt,subpage_prot,switch_endian,vm86,vm86old
@debug=lookup_dcookie,perf_event_open,process_vm_writev,rtas,s390_runtime_instr,sys_debug_setcontext
@obsolete=_sysctl,afs_syscall,bdflush,break,create_module,ftime,get_kernel_syms,getpmsg,gtty,lock,mpx,prof,profil,putpmsg,query_module,security,sgetmask,ssetmask,stty,sysfs,tuxcall,ulimit,uselib,ustat,vserver
@resources=mbind,migrate_pages,move_pages,set_mempolicy
@default=@cpu-emulation,@debug,@obsolete,@privileged,@resources,add_key,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,name_to_handle_at,ni_syscall,open_by_handle_at,remap_file_pages,request_key,syslog,umount,userfaultfd,vmsplice
@default-nodebuggers=@default,personality,process_vm_readv,ptrace
@default-keep=execve,prctl
Inheritance of groups
---------------------
+---------+----------------+---------------+
| @clock | @cpu-emulation | @default-keep |
| @module | @debug | |
| @raw-io | @obsolete | |
| @reboot | @resources | |
| @swap | | |
+---------+----------------+---------------+
: :
+-------------+ :
| @privileged | :
+-------------+ :
: :
+----------+ :
| @default |........:
+----------+
:
+----------------------+
| @default-nodebuggers |
+----------------------+
common used seccomp.drop lines
------------------------------
@default without chroot: @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,pivot_root,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice
@default-nodebuggers without chroot: @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice
Building a seccomp.drop line if seccomp breaks a programm
---------------------------------------------------------
```
$ journalctl --grep=syscall --follow
<...> audit[…]: SECCOMP <...> syscall=161 <...>
$ firejail --debug-syscalls | grep 161
161 - chroot
```
TODO: write a short explanation
TODO: suggest to use `allow-debuggers` instead of `seccomp.drop` if possible
see also
--------
- contrib/syscalls.sh
- https://firejail.wordpress.com/documentation-2/seccomp-guide/
|
