diff options
| author | Ray Essick <essick@google.com> | 2019-10-31 13:53:05 -0700 |
|---|---|---|
| committer | Elliott Hughes <enh@google.com> | 2019-11-08 08:20:29 -0800 |
| commit | e5c41439375d2d48a641b4b13d61542e1708a333 (patch) | |
| tree | ab0a1dc0ebfb77e05878796003b1f6c1f4fe0535 /code_coverage/seccomp_policy/code_coverage.policy.def | |
| parent | 107bbbff4f7abe5f41242cf1a8b34346272f2e05 (diff) | |
configs for jailed procs to dump code coverage data
list system calls used for dumping code coverage information; empty on
non code coverage builds. Mini-jail configurations can include this file
instead of trying to manage the list themselves.
Bug: 139313557
Test: arm32/arm64/x86 media svcs w/native coverage on, kill -37 to dump stats.
Change-Id: I7323a9739803756a76f54e4a98e995522cab71ef
Diffstat (limited to 'code_coverage/seccomp_policy/code_coverage.policy.def')
| -rw-r--r-- | code_coverage/seccomp_policy/code_coverage.policy.def | 51 |
1 files changed, 51 insertions, 0 deletions
diff --git a/code_coverage/seccomp_policy/code_coverage.policy.def b/code_coverage/seccomp_policy/code_coverage.policy.def new file mode 100644 index 0000000000..f136084bcd --- /dev/null +++ b/code_coverage/seccomp_policy/code_coverage.policy.def @@ -0,0 +1,51 @@ +// SECCOMP_MODE_STRICT +// +// minijail allowances for code coverage +// this is processed with generate.sh, so we can use appropriate directives +// size specific: __LP64__ for 64 bit, else 32 bit +// arch specific: __arm__, __aarch64__, __i386__, __x86_64__ + +// includes *all* syscalls used during the coverage dumping +// no skipping just because they might have been in another policy file. + +// coverage tool uses different operations on different passes +// 1st: uses write() to fill the file +// 2nd-Nth: uses mmap() to update in place + +close: 1 +mkdirat: 1 +msync: 1 +munmap: 1 +openat: 1 +write: 1 + +#if defined(__LP64__) +fcntl: 1 +fstat: 1 +geteuid: 1 +lseek: 1 +mmap: 1 +rt_sigreturn: 1 +#else +fcntl64: 1 +fstat64: 1 +geteuid32: 1 +_llseek: 1 +mmap2: 1 +sigreturn: 1 +#endif + +#if defined(__arm__) +gettimeofday: 1 +#endif + +#if defined(__i386__) +madvise: 1 +#endif + +#if defined(__arm__) +prctl: 1 +#elif defined(__aarch64__) +prctl: 1 +#endif + |