syscalls.cm

# Safe operations.
#
# Some of these look obviously wrong: of course read requires an IO
# capability, right‽ True, it does. But it's _already happened_ at
# the point read is called, and we can get a more specific
# capability by seeing which syscall created the fd.
read CAPABILITY_SAFE
write CAPABILITY_SAFE
close CAPABILITY_SAFE
fstat CAPABILITY_SAFE
poll CAPABILITY_SAFE
lseek CAPABILITY_SAFE
mprotect CAPABILITY_SAFE
mmap CAPABILITY_SAFE
munmap CAPABILITY_SAFE
brk CAPABILITY_SAFE
rt_sigaction CAPABILITY_SAFE
rt_sigprocmask CAPABILITY_SAFE
rt_sigreturn CAPABILITY_SAFE
pread64 CAPABILITY_SAFE
pwrite64 CAPABILITY_SAFE
readv CAPABILITY_SAFE
writev CAPABILITY_SAFE
pipe CAPABILITY_SAFE
select CAPABILITY_SAFE
sched_yield CAPABILITY_SAFE
mremap CAPABILITY_SAFE
msync CAPABILITY_SAFE
mincore CAPABILITY_SAFE
madvise CAPABILITY_SAFE
dup CAPABILITY_SAFE
dup2 CAPABILITY_SAFE
pause CAPABILITY_SAFE
nanosleep CAPABILITY_SAFE
getitimer CAPABILITY_SAFE
alarm CAPABILITY_SAFE
setitimer CAPABILITY_SAFE
sendfile CAPABILITY_SAFE
connect CAPABILITY_SAFE
accept CAPABILITY_SAFE
sendto CAPABILITY_SAFE
recvfrom CAPABILITY_SAFE
sendmsg CAPABILITY_SAFE
recvmsg CAPABILITY_SAFE
shutdown CAPABILITY_SAFE
bind CAPABILITY_SAFE
listen CAPABILITY_SAFE
getsockname CAPABILITY_SAFE
getpeername CAPABILITY_SAFE
socketpair CAPABILITY_SAFE
setsockopt CAPABILITY_SAFE
getsockopt CAPABILITY_SAFE
clone CAPABILITY_SAFE
fork CAPABILITY_SAFE
vfork CAPABILITY_SAFE
exit CAPABILITY_SAFE
wait4 CAPABILITY_SAFE
fcntl CAPABILITY_SAFE
ftruncate CAPABILITY_SAFE
getdents CAPABILITY_SAFE
gettimeofday CAPABILITY_SAFE
times CAPABILITY_SAFE
capget CAPABILITY_SAFE
capset CAPABILITY_SAFE
rt_sigpending CAPABILITY_SAFE
rt_sigtimedwait CAPABILITY_SAFE
rt_sigsuspend CAPABILITY_SAFE
sigaltstack CAPABILITY_SAFE
utime CAPABILITY_SAFE
personality CAPABILITY_SAFE
getpriority CAPABILITY_SAFE
setpriority CAPABILITY_SAFE
mlock CAPABILITY_SAFE
munlock CAPABILITY_SAFE
mlockall CAPABILITY_SAFE
munlockall CAPABILITY_SAFE
vhangup CAPABILITY_SAFE
modify_ldt CAPABILITY_SAFE
prctl CAPABILITY_SAFE
arch_prctl CAPABILITY_SAFE
iopl CAPABILITY_SAFE
ioperm CAPABILITY_SAFE
getpmsg CAPABILITY_SAFE
putpmsg CAPABILITY_SAFE
afs_syscall CAPABILITY_SAFE
tuxcall CAPABILITY_SAFE
security CAPABILITY_SAFE
readahead CAPABILITY_SAFE
time CAPABILITY_SAFE
futex CAPABILITY_SAFE
set_thread_area CAPABILITY_SAFE
io_setup CAPABILITY_SAFE
io_destroy CAPABILITY_SAFE
io_getevents CAPABILITY_SAFE
io_submit CAPABILITY_SAFE
io_cancel CAPABILITY_SAFE
exit_group CAPABILITY_SAFE
get_thread_area CAPABILITY_SAFE
epoll_create CAPABILITY_SAFE
epoll_ctl_old CAPABILITY_SAFE
epoll_wait_old CAPABILITY_SAFE
remap_file_pages CAPABILITY_SAFE
getdents64 CAPABILITY_SAFE
set_tid_address CAPABILITY_SAFE
fadvise64 CAPABILITY_SAFE
timer_create CAPABILITY_SAFE
timer_settime CAPABILITY_SAFE
timer_gettime CAPABILITY_SAFE
timer_getoverrun CAPABILITY_SAFE
timer_delete CAPABILITY_SAFE
clock_gettime CAPABILITY_SAFE
clock_getres CAPABILITY_SAFE
clock_nanosleep CAPABILITY_SAFE
epoll_wait CAPABILITY_SAFE
epoll_ctl CAPABILITY_SAFE
vserver CAPABILITY_SAFE
mbind CAPABILITY_SAFE
set_mempolicy CAPABILITY_SAFE
get_mempolicy CAPABILITY_SAFE
waitid CAPABILITY_SAFE
ioprio_set CAPABILITY_SAFE
ioprio_get CAPABILITY_SAFE
inotify_init CAPABILITY_SAFE
inotify_rm_watch CAPABILITY_SAFE
migrate_pages CAPABILITY_SAFE
pselect6 CAPABILITY_SAFE
ppoll CAPABILITY_SAFE
unshare CAPABILITY_SAFE
set_robust_list CAPABILITY_SAFE
get_robust_list CAPABILITY_SAFE
splice CAPABILITY_SAFE
tee CAPABILITY_SAFE
sync_file_range CAPABILITY_SAFE
vmsplice CAPABILITY_SAFE
epoll_pwait CAPABILITY_SAFE
signalfd CAPABILITY_SAFE
timerfd_create CAPABILITY_SAFE
eventfd CAPABILITY_SAFE
fallocate CAPABILITY_SAFE
timerfd_settime CAPABILITY_SAFE
timerfd_gettime CAPABILITY_SAFE
accept4 CAPABILITY_SAFE
signalfd4 CAPABILITY_SAFE
eventfd2 CAPABILITY_SAFE
epoll_create1 CAPABILITY_SAFE
dup3 CAPABILITY_SAFE
pipe2 CAPABILITY_SAFE
inotify_init1 CAPABILITY_SAFE
preadv CAPABILITY_SAFE
pwritev CAPABILITY_SAFE
perf_event_open CAPABILITY_SAFE
recvmmsg CAPABILITY_SAFE
fanotify_init CAPABILITY_SAFE
sendmmsg CAPABILITY_SAFE
setns CAPABILITY_SAFE
seccomp CAPABILITY_SAFE
getrandom CAPABILITY_SAFE
memfd_create CAPABILITY_SAFE
userfaultfd CAPABILITY_SAFE
membarrier CAPABILITY_SAFE
mlock2 CAPABILITY_SAFE
copy_file_range CAPABILITY_SAFE
preadv2 CAPABILITY_SAFE
pwritev2 CAPABILITY_SAFE
pkey_mprotect CAPABILITY_SAFE
pkey_alloc CAPABILITY_SAFE
pkey_free CAPABILITY_SAFE
io_pgetevents CAPABILITY_SAFE
clone3 CAPABILITY_SAFE
close_range CAPABILITY_SAFE
epoll_pwait2 CAPABILITY_SAFE
landlock_create_ruleset CAPABILITY_SAFE
landlock_add_rule CAPABILITY_SAFE
landlock_restrict_self CAPABILITY_SAFE
memfd_secret CAPABILITY_SAFE
futex_waitv CAPABILITY_SAFE
set_mempolicy_home_node CAPABILITY_SAFE
cachestat CAPABILITY_SAFE
map_shadow_stack CAPABILITY_SAFE
futex_wake CAPABILITY_SAFE
futex_wait CAPABILITY_SAFE
futex_requeue CAPABILITY_SAFE
restart_syscall CAPABILITY_SAFE

# The various rlimit and rusage syscalls are kind of arguable, but since they're
# ultimately handling process-specific things, we'll call them safe.
getrusage CAPABILITY_SAFE
getrlimit CAPABILITY_SAFE
setrlimit CAPABILITY_SAFE
prlimit64 CAPABILITY_SAFE

execve CAPABILITY_EXEC
uselib CAPABILITY_EXEC
execveat CAPABILITY_EXEC

open CAPABILITY_FILES
stat CAPABILITY_FILES
lstat CAPABILITY_FILES
access CAPABILITY_FILES
fsync CAPABILITY_FILES
fdatasync CAPABILITY_FILES
truncate CAPABILITY_FILES
rename CAPABILITY_FILES
mkdir CAPABILITY_FILES
rmdir CAPABILITY_FILES
creat CAPABILITY_FILES
link CAPABILITY_FILES
unlink CAPABILITY_FILES
symlink CAPABILITY_FILES
readlink CAPABILITY_FILES
chmod CAPABILITY_FILES
fchmod CAPABILITY_FILES
chown CAPABILITY_FILES
fchown CAPABILITY_FILES
lchown CAPABILITY_FILES
mknod CAPABILITY_FILES
setxattr CAPABILITY_FILES
lsetxattr CAPABILITY_FILES
fsetxattr CAPABILITY_FILES
getxattr CAPABILITY_FILES
lgetxattr CAPABILITY_FILES
fgetxattr CAPABILITY_FILES
listxattr CAPABILITY_FILES
llistxattr CAPABILITY_FILES
flistxattr CAPABILITY_FILES
removexattr CAPABILITY_FILES
lremovexattr CAPABILITY_FILES
fremovexattr CAPABILITY_FILES
lookup_dcookie CAPABILITY_FILES
utimes CAPABILITY_FILES
inotify_add_watch CAPABILITY_FILES
openat CAPABILITY_FILES
mkdirat CAPABILITY_FILES
mknodat CAPABILITY_FILES
fchownat CAPABILITY_FILES
futimesat CAPABILITY_FILES
newfstatat CAPABILITY_FILES
unlinkat CAPABILITY_FILES
renameat CAPABILITY_FILES
linkat CAPABILITY_FILES
symlinkat CAPABILITY_FILES
readlinkat CAPABILITY_FILES
fchmodat CAPABILITY_FILES
faccessat CAPABILITY_FILES
utimensat CAPABILITY_FILES
fanotify_mark CAPABILITY_FILES
name_to_handle_at CAPABILITY_FILES
open_by_handle_at CAPABILITY_FILES
renameat2 CAPABILITY_FILES
statx CAPABILITY_FILES
rseq CAPABILITY_FILES
io_uring_setup CAPABILITY_FILES
io_uring_enter CAPABILITY_FILES
open_tree CAPABILITY_FILES
openat2 CAPABILITY_FILES
faccessat2 CAPABILITY_FILES
fchmodat2 CAPABILITY_FILES

kill CAPABILITY_MODIFY_SYSTEM_STATE
chdir CAPABILITY_MODIFY_SYSTEM_STATE
fchdir CAPABILITY_MODIFY_SYSTEM_STATE
setuid CAPABILITY_MODIFY_SYSTEM_STATE
setgid CAPABILITY_MODIFY_SYSTEM_STATE
setpgid CAPABILITY_MODIFY_SYSTEM_STATE
setsid CAPABILITY_MODIFY_SYSTEM_STATE
setreuid CAPABILITY_MODIFY_SYSTEM_STATE
setregid CAPABILITY_MODIFY_SYSTEM_STATE
setgroups CAPABILITY_MODIFY_SYSTEM_STATE
setresuid CAPABILITY_MODIFY_SYSTEM_STATE
setresgid CAPABILITY_MODIFY_SYSTEM_STATE
setfsuid CAPABILITY_MODIFY_SYSTEM_STATE
setfsgid CAPABILITY_MODIFY_SYSTEM_STATE
rt_sigqueueinfo CAPABILITY_MODIFY_SYSTEM_STATE
pivot_root CAPABILITY_MODIFY_SYSTEM_STATE
adjtimex CAPABILITY_MODIFY_SYSTEM_STATE
chroot CAPABILITY_MODIFY_SYSTEM_STATE
sync CAPABILITY_MODIFY_SYSTEM_STATE
settimeofday CAPABILITY_MODIFY_SYSTEM_STATE
mount CAPABILITY_MODIFY_SYSTEM_STATE
umount2 CAPABILITY_MODIFY_SYSTEM_STATE
swapon CAPABILITY_MODIFY_SYSTEM_STATE
swapoff CAPABILITY_MODIFY_SYSTEM_STATE
reboot CAPABILITY_MODIFY_SYSTEM_STATE
sethostname CAPABILITY_MODIFY_SYSTEM_STATE
setdomainname CAPABILITY_MODIFY_SYSTEM_STATE
delete_module CAPABILITY_MODIFY_SYSTEM_STATE
tkill CAPABILITY_MODIFY_SYSTEM_STATE
clock_settime CAPABILITY_MODIFY_SYSTEM_STATE
tgkill CAPABILITY_MODIFY_SYSTEM_STATE
add_key CAPABILITY_MODIFY_SYSTEM_STATE
keyctl CAPABILITY_MODIFY_SYSTEM_STATE
move_pages CAPABILITY_MODIFY_SYSTEM_STATE
rt_tgsigqueueinfo CAPABILITY_MODIFY_SYSTEM_STATE
clock_adjtime CAPABILITY_MODIFY_SYSTEM_STATE
syncfs CAPABILITY_MODIFY_SYSTEM_STATE
process_vm_readv CAPABILITY_MODIFY_SYSTEM_STATE
process_vm_writev CAPABILITY_MODIFY_SYSTEM_STATE
finit_module CAPABILITY_MODIFY_SYSTEM_STATE
bpf CAPABILITY_MODIFY_SYSTEM_STATE
pidfd_send_signal CAPABILITY_MODIFY_SYSTEM_STATE
process_madvise CAPABILITY_MODIFY_SYSTEM_STATE
process_mrelease CAPABILITY_MODIFY_SYSTEM_STATE

getpid CAPABILITY_READ_SYSTEM_STATE
uname CAPABILITY_READ_SYSTEM_STATE
getcwd CAPABILITY_READ_SYSTEM_STATE
umask CAPABILITY_READ_SYSTEM_STATE
sysinfo CAPABILITY_READ_SYSTEM_STATE
getuid CAPABILITY_READ_SYSTEM_STATE
getgid CAPABILITY_READ_SYSTEM_STATE
geteuid CAPABILITY_READ_SYSTEM_STATE
getegid CAPABILITY_READ_SYSTEM_STATE
getppid CAPABILITY_READ_SYSTEM_STATE
getpgrp CAPABILITY_READ_SYSTEM_STATE
getgroups CAPABILITY_READ_SYSTEM_STATE
getresuid CAPABILITY_READ_SYSTEM_STATE
getresgid CAPABILITY_READ_SYSTEM_STATE
getpgid CAPABILITY_READ_SYSTEM_STATE
getsid CAPABILITY_READ_SYSTEM_STATE
sched_get_priority_max CAPABILITY_READ_SYSTEM_STATE
sched_get_priority_min CAPABILITY_READ_SYSTEM_STATE
get_kernel_syms CAPABILITY_READ_SYSTEM_STATE
query_module CAPABILITY_READ_SYSTEM_STATE
gettid CAPABILITY_READ_SYSTEM_STATE
request_key CAPABILITY_READ_SYSTEM_STATE
getcpu CAPABILITY_READ_SYSTEM_STATE
kcmp CAPABILITY_READ_SYSTEM_STATE
pidfd_open CAPABILITY_READ_SYSTEM_STATE
pidfd_getfd CAPABILITY_READ_SYSTEM_STATE

ustat CAPABILITY_FILES CAPABILITY_READ_SYSTEM_STATE
statfs CAPABILITY_FILES CAPABILITY_READ_SYSTEM_STATE
fstatfs CAPABILITY_FILES CAPABILITY_READ_SYSTEM_STATE
sysfs CAPABILITY_FILES CAPABILITY_READ_SYSTEM_STATE
quotactl CAPABILITY_FILES CAPABILITY_READ_SYSTEM_STATE
nfsservctl CAPABILITY_FILES CAPABILITY_READ_SYSTEM_STATE
move_mount CAPABILITY_FILES CAPABILITY_READ_SYSTEM_STATE
fsopen CAPABILITY_FILES CAPABILITY_READ_SYSTEM_STATE
fsconfig CAPABILITY_FILES CAPABILITY_READ_SYSTEM_STATE
fsmount CAPABILITY_FILES CAPABILITY_READ_SYSTEM_STATE
fspick CAPABILITY_FILES CAPABILITY_READ_SYSTEM_STATE
mount_setattr CAPABILITY_FILES CAPABILITY_READ_SYSTEM_STATE
quotactl_fd CAPABILITY_FILES CAPABILITY_READ_SYSTEM_STATE

create_module CAPABILITY_FILES CAPABILITY_MODIFY_SYSTEM_STATE
init_module CAPABILITY_FILES CAPABILITY_MODIFY_SYSTEM_STATE
kexec_load CAPABILITY_FILES CAPABILITY_MODIFY_SYSTEM_STATE
kexec_file_load CAPABILITY_FILES CAPABILITY_MODIFY_SYSTEM_STATE

# These scare me, so they get all the relevant capabilites for now. Runtime
# analysis could narrow this down based on the parameters.
ioctl CAPABILITY_FILES CAPABILITY_NETWORK CAPABILITY_READ_SYSTEM_STATE CAPABILITY_MODIFY_SYSTEM_STATE
socket CAPABILITY_FILES CAPABILITY_NETWORK CAPABILITY_READ_SYSTEM_STATE CAPABILITY_MODIFY_SYSTEM_STATE

ptrace CAPABILITY_EXEC CAPABILITY_ARBITRARY_EXECUTION

shmget CAPABILITY_READ_SYSTEM_STATE CAPABILITY_MODIFY_SYSTEM_STATE
shmat CAPABILITY_READ_SYSTEM_STATE CAPABILITY_MODIFY_SYSTEM_STATE
shmctl CAPABILITY_READ_SYSTEM_STATE CAPABILITY_MODIFY_SYSTEM_STATE
semget CAPABILITY_READ_SYSTEM_STATE CAPABILITY_MODIFY_SYSTEM_STATE
semop CAPABILITY_READ_SYSTEM_STATE CAPABILITY_MODIFY_SYSTEM_STATE
semctl CAPABILITY_READ_SYSTEM_STATE CAPABILITY_MODIFY_SYSTEM_STATE
shmdt CAPABILITY_READ_SYSTEM_STATE CAPABILITY_MODIFY_SYSTEM_STATE
msgget CAPABILITY_READ_SYSTEM_STATE CAPABILITY_MODIFY_SYSTEM_STATE
msgsnd CAPABILITY_READ_SYSTEM_STATE CAPABILITY_MODIFY_SYSTEM_STATE
msgrcv CAPABILITY_READ_SYSTEM_STATE CAPABILITY_MODIFY_SYSTEM_STATE
msgctl CAPABILITY_READ_SYSTEM_STATE CAPABILITY_MODIFY_SYSTEM_STATE
flock CAPABILITY_READ_SYSTEM_STATE CAPABILITY_MODIFY_SYSTEM_STATE
syslog CAPABILITY_READ_SYSTEM_STATE CAPABILITY_MODIFY_SYSTEM_STATE
_sysctl CAPABILITY_READ_SYSTEM_STATE CAPABILITY_MODIFY_SYSTEM_STATE
semtimedop CAPABILITY_READ_SYSTEM_STATE CAPABILITY_MODIFY_SYSTEM_STATE
mq_open CAPABILITY_READ_SYSTEM_STATE CAPABILITY_MODIFY_SYSTEM_STATE
mq_unlink CAPABILITY_READ_SYSTEM_STATE CAPABILITY_MODIFY_SYSTEM_STATE
mq_timedsend CAPABILITY_READ_SYSTEM_STATE CAPABILITY_MODIFY_SYSTEM_STATE
mq_timedreceive CAPABILITY_READ_SYSTEM_STATE CAPABILITY_MODIFY_SYSTEM_STATE
mq_notify CAPABILITY_READ_SYSTEM_STATE CAPABILITY_MODIFY_SYSTEM_STATE
mq_getsetattr CAPABILITY_READ_SYSTEM_STATE CAPABILITY_MODIFY_SYSTEM_STATE
sched_setparam CAPABILITY_READ_SYSTEM_STATE CAPABILITY_MODIFY_SYSTEM_STATE
sched_getparam CAPABILITY_READ_SYSTEM_STATE CAPABILITY_MODIFY_SYSTEM_STATE
sched_setscheduler CAPABILITY_READ_SYSTEM_STATE CAPABILITY_MODIFY_SYSTEM_STATE
sched_getscheduler CAPABILITY_READ_SYSTEM_STATE CAPABILITY_MODIFY_SYSTEM_STATE
sched_rr_get_interval CAPABILITY_READ_SYSTEM_STATE CAPABILITY_MODIFY_SYSTEM_STATE
sched_setaffinity CAPABILITY_READ_SYSTEM_STATE CAPABILITY_MODIFY_SYSTEM_STATE
sched_getaffinity CAPABILITY_READ_SYSTEM_STATE CAPABILITY_MODIFY_SYSTEM_STATE
sched_setattr CAPABILITY_READ_SYSTEM_STATE CAPABILITY_MODIFY_SYSTEM_STATE
sched_getattr CAPABILITY_READ_SYSTEM_STATE CAPABILITY_MODIFY_SYSTEM_STATE

# Special cases where the capabilities depend on the syscall arguments.
acct CAPABILITY_ARBITRARY_EXECUTION
#mmap CAPABILITY_ARBITRARY_EXECUTION