// These policies are heavily influenced by Docker's default profile. Further // customization done on top: // // - Avoid syscalls that need root anyway. The policies here are mostly meant to // be used by unprivileged users (not containers with root inside). The // syscalls wouldn't be harmful, but would result in larger BPF programs that // in turn incur more overhead. // - Avoid rarely used syscalls that can be abused for yet more fingerprinting // on desktop applications. This category mostly contains syscalls useful for // profiling (e.g. mincore, cachestat). // - Split them into categories inspired by systemD's seccomp filter sets and // OpenBSD's pledge promises.

POLICY Aio { ALLOW { io_cancel, io_destroy, io_getevents, io_pgetevents, io_setup, io_submit } }

POLICY BasicIo { ALLOW { read, readv, tee, vmsplice, write, writev,

// ioctl() is definitively not about generic/stream/basic I/O. ioctl() // is really a syscall in disguise that device drivers can use for // anything.…