弱沙箱使能seccomp策略-startup

Mbegetd.gni+3-0

	@@ -85,4 +85,7 @@ declare_args() {
85		85
86	# only the pc can obtain the device serial number	86	# only the pc can obtain the device serial number
87	init_get_disk_sn = false	87	init_get_disk_sn = false
		88	+
		89	+ # seccomp custom
		90	+ init_feature_custom_sandbox = false
88	}	91	}

Mbundle.json+2-1

	@@ -35,7 +35,8 @@
35	"init_feature_group_type",	35	"init_feature_group_type",
36	"init_feature_enable_lite_process_priority",	36	"init_feature_enable_lite_process_priority",
37	"init_feature_use_hook_mgr",	37	"init_feature_use_hook_mgr",
38	- "init_get_disk_sn"	38	+ "init_get_disk_sn",
		39	+ "init_feature_custom_sandbox"
39	],	40	],
40	"adapted_system_type": [	41	"adapted_system_type": [
41	"mini",	42	"mini",

Minterfaces/innerkits/seccomp/include/seccomp_policy.h+1-0

	@@ -32,6 +32,7 @@ extern "C" {
32	#define IMF_EXTENTOIN_NAME "imf_secure_mode"	32	#define IMF_EXTENTOIN_NAME "imf_secure_mode"
33	#define APP_PRIVILEGE "app_privilege"	33	#define APP_PRIVILEGE "app_privilege"
34	#define APP_ATOMIC "app_atomic"	34	#define APP_ATOMIC "app_atomic"
		35	+#define APP_CUSTOM "app_custom"
35		36
36	typedef enum {	37	typedef enum {
37	SYSTEM_SA, // system service process	38	SYSTEM_SA, // system service process

Mservices/modules/seccomp/BUILD.gn+16-0

	@@ -132,6 +132,19 @@ ohos_prebuilt_seccomp("updater_filter") {
132	install_images = [ "updater" ]	132	install_images = [ "updater" ]
133	}	133	}
134		134
		135	+ohos_prebuilt_seccomp("app_custom_filter") {
		136	+ sources = [ "seccomp_policy/app_custom.seccomp.policy" ]
		137	+
		138	+ filtername = "app_custom"
		139	+ process_type = "app"
		140	+
		141	+ part_name = INIT_PART
		142	+ subsystem_name = "startup"
		143	+
		144	+ install_enable = true
		145	+ install_images = [ "system" ]
		146	+}
		147	+
135	config("libseccomp_static_config") {	148	config("libseccomp_static_config") {
136	include_dirs = [	149	include_dirs = [
137	"..",	150	"..",
	@@ -179,6 +192,9 @@ group("seccomp_filter") {
179	":appspawn_filter",	192	":appspawn_filter",
180	":nwebspawn_filter",	193	":nwebspawn_filter",
181	]	194	]
		195	+ if (init_feature_custom_sandbox) {
		196	+ deps += [ ":app_custom_filter" ]
		197	+ }
182	if (init_feature_seccomp_privilege) {	198	if (init_feature_seccomp_privilege) {
183	deps += [ ":app_privilege_filter" ]	199	deps += [ ":app_privilege_filter" ]
184	}	200	}

Aservices/modules/seccomp/seccomp_policy/app_custom.seccomp.policy+332-0

@@ -0,0 +1,332 @@
	1	+# Copyright (c) 2025 Huawei Device Co., Ltd.
	2	+# Licensed under the Apache License, Version 2.0 (the "License");
	3	+# you may not use this file except in compliance with the License.
	4	+# You may obtain a copy of the License at
	5	+#
	6	+# http://www.apache.org/licenses/LICENSE-2.0
	7	+#
	8	+# Unless required by applicable law or agreed to in writing, software
	9	+# distributed under the License is distributed on an "AS IS" BASIS,
	10	+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	11	+# See the License for the specific language governing permissions and
	12	+# limitations under the License.
	13	+
	14	+# For now, it supports architechture of ['arm', 'arm64', 'riscv64'].
	15	+
	16	+@returnValue
	17	+TRAP
	18	+
	19	+@headFiles
	20	+<linux/sched.h>
	21	+<stdint.h>
	22	+
	23	+@priority
	24	+ioctl;all
	25	+futex;all
	26	+
	27	+@allowList
	28	+io_setup;all
	29	+io_destroy;all
	30	+io_submit;all
	31	+io_cancel;all
	32	+io_getevents;all
	33	+setxattr;all
	34	+lsetxattr;all
	35	+fsetxattr;all
	36	+getxattr;all
	37	+lgetxattr;all
	38	+fgetxattr;all
	39	+listxattr;all
	40	+llistxattr;all
	41	+flistxattr;all
	42	+removexattr;all
	43	+lremovexattr;all
	44	+fremovexattr;all
	45	+getcwd;all
	46	+eventfd2;all
	47	+epoll_create1;all
	48	+epoll_ctl;all
	49	+epoll_pwait;all
	50	+dup;all
	51	+dup3;all
	52	+fcntl;all
	53	+inotify_init1;all
	54	+inotify_add_watch;all
	55	+inotify_rm_watch;all
	56	+ioctl;all
	57	+ioprio_set;arm64
	58	+ioprio_set;riscv64
	59	+ioprio_get;arm64
	60	+ioprio_get;riscv64
	61	+flock;all
	62	+mknodat;all
	63	+mkdirat;all
	64	+unlinkat;all
	65	+symlinkat;all
	66	+linkat;all
	67	+renameat;arm
	68	+renameat;arm64
	69	+pivot_root;riscv64
	70	+statfs;arm64
	71	+statfs;riscv64
	72	+fstatfs;arm64
	73	+fstatfs;riscv64
	74	+truncate;all
	75	+ftruncate;arm64
	76	+ftruncate;riscv64
	77	+fallocate;all
	78	+faccessat;all
	79	+chdir;all
	80	+fchdir;all
	81	+fchmod;all
	82	+fchmodat;all
	83	+fchownat;all
	84	+fchown;arm64
	85	+fchown;riscv64
	86	+openat;all
	87	+close;all
	88	+pipe2;all
	89	+quotactl;all
	90	+getdents64;all
	91	+lseek;all
	92	+read;all
	93	+write;all
	94	+readv;all
	95	+writev;all
	96	+pread64;all
	97	+pwrite64;all
	98	+preadv;all
	99	+pwritev;all
	100	+sendfile;all
	101	+pselect6;all
	102	+ppoll;all
	103	+signalfd4;all
	104	+vmsplice;all
	105	+splice;all
	106	+tee;all
	107	+readlinkat;all
	108	+newfstatat;arm64
	109	+newfstatat;riscv64
	110	+fstat;arm64
	111	+fstat;riscv64
	112	+sync;all
	113	+fsync;all
	114	+fdatasync;all
	115	+sync_file_range;arm64
	116	+sync_file_range;riscv64
	117	+timerfd_create;all
	118	+timerfd_settime;all
	119	+timerfd_gettime;all
	120	+utimensat;all
	121	+capget;all
	122	+capset;all
	123	+personality;all
	124	+exit;all
	125	+exit_group;all
	126	+waitid;all
	127	+set_tid_address;all
	128	+futex;all
	129	+nanosleep;all
	130	+getitimer;all
	131	+setitimer;all
	132	+timer_create;all
	133	+timer_gettime;all
	134	+timer_getoverrun;all
	135	+timer_settime;all
	136	+timer_delete;all
	137	+clock_gettime;all
	138	+clock_getres;all
	139	+clock_nanosleep;all
	140	+ptrace;all
	141	+sched_setparam;all
	142	+sched_setscheduler;all
	143	+sched_getscheduler;all
	144	+sched_getparam;all
	145	+sched_setaffinity;all
	146	+sched_getaffinity;all
	147	+sched_yield;all
	148	+sched_get_priority_max;all
	149	+sched_get_priority_min;all
	150	+sched_rr_get_interval;all
	151	+restart_syscall;all
	152	+kill;all
	153	+tkill;all
	154	+tgkill;all
	155	+sigaltstack;all
	156	+rt_sigsuspend;all
	157	+rt_sigaction;all
	158	+rt_sigprocmask;all
	159	+rt_sigpending;all
	160	+rt_sigtimedwait;all
	161	+rt_sigqueueinfo;all
	162	+rt_sigreturn;all
	163	+setpriority;all
	164	+getpriority;all
	165	+setresuid;arm64
	166	+setresuid;riscv64
	167	+getresuid;arm64
	168	+getresuid;riscv64
	169	+getresgid;arm64
	170	+getresgid;riscv64
	171	+times;all
	172	+setpgid;all
	173	+getpgid;all
	174	+getsid;all
	175	+setsid;all
	176	+getgroups;arm64
	177	+getgroups;riscv64
	178	+uname;all
	179	+getrlimit;arm64
	180	+getrlimit;riscv64
	181	+setrlimit;all
	182	+getrusage;all
	183	+umask;all
	184	+prctl;all
	185	+getcpu;all
	186	+gettimeofday;all
	187	+getpid;all
	188	+getppid;all
	189	+getuid;all
	190	+geteuid;arm64
	191	+geteuid;riscv64
	192	+getgid;arm64
	193	+getgid;riscv64
	194	+getegid;arm64
	195	+getegid;riscv64
	196	+gettid;all
	197	+sysinfo;all
	198	+socket;all
	199	+socketpair;all
	200	+bind;all
	201	+listen;all
	202	+accept;all
	203	+connect;all
	204	+getsockname;all
	205	+getpeername;all
	206	+sendto;all
	207	+recvfrom;all
	208	+setsockopt;all
	209	+getsockopt;all
	210	+shutdown;all
	211	+sendmsg;all
	212	+recvmsg;all
	213	+readahead;all
	214	+brk;all
	215	+munmap;all
	216	+mremap;all
	217	+execve;all
	218	+mmap;arm64
	219	+mmap;riscv64
	220	+fadvise64;arm64
	221	+fadvise64;riscv64
	222	+mprotect;all
	223	+msync;all
	224	+mlock;all
	225	+munlock;all
	226	+mlockall;all
	227	+munlockall;all
	228	+mincore;all
	229	+madvise;all
	230	+rt_tgsigqueueinfo;all
	231	+perf_event_open;all
	232	+accept4;all
	233	+recvmmsg;all
	234	+wait4;all
	235	+prlimit64;all
	236	+syncfs;all
	237	+sendmmsg;all
	238	+process_vm_readv;all
	239	+process_vm_writev;all
	240	+sched_setattr;all
	241	+sched_getattr;all
	242	+renameat2;all
	243	+seccomp;all
	244	+getrandom;all
	245	+memfd_create;all
	246	+execveat;all
	247	+userfaultfd;all
	248	+membarrier;all
	249	+mlock2;all
	250	+copy_file_range;all
	251	+preadv2;all
	252	+pwritev2;all
	253	+statx;all
	254	+pidfd_send_signal;all
	255	+pidfd_open;all
	256	+pidfd_getfd;all
	257	+faccessat2;all
	258	+process_madvise;all
	259	+set_robust_list;all
	260	+fork;arm
	261	+open;arm
	262	+creat;arm
	263	+link;arm
	264	+unlink;arm
	265	+chmod;arm
	266	+access;arm
	267	+rename;arm
	268	+mkdir;arm
	269	+rmdir;arm
	270	+pipe;arm
	271	+dup2;arm
	272	+sigaction;arm
	273	+symlink;arm
	274	+readlink;arm
	275	+sigreturn;arm
	276	+_llseek;arm
	277	+getdents;arm
	278	+_newselect;arm
	279	+poll;arm
	280	+vfork;arm
	281	+ugetrlimit;arm
	282	+mmap2;arm
	283	+truncate64;arm
	284	+ftruncate64;arm
	285	+stat64;arm
	286	+lstat64;arm
	287	+fstat64;arm
	288	+lchown32;arm
	289	+getuid32;arm
	290	+getgid32;arm
	291	+geteuid32;arm
	292	+getegid32;arm
	293	+getgroups32;arm
	294	+fchown32;arm
	295	+setresuid32;arm
	296	+getresuid32;arm
	297	+getresgid32;arm
	298	+chown32;arm
	299	+fcntl64;arm
	300	+sendfile64;arm
	301	+epoll_create;arm
	302	+epoll_wait;arm
	303	+remap_file_pages;arm
	304	+statfs64;arm
	305	+fstatfs64;arm
	306	+fadvise64_64;arm
	307	+inotify_init;arm
	308	+fstatat64;arm
	309	+sync_file_range2;arm
	310	+eventfd;arm
	311	+clock_gettime64;arm
	312	+clock_settime64;arm
	313	+clock_adjtime64;arm
	314	+clock_getres_time64;arm
	315	+clock_nanosleep_time64;arm
	316	+timer_gettime64;arm
	317	+timer_settime64;arm
	318	+timerfd_gettime64;arm
	319	+timerfd_settime64;arm
	320	+utimensat_time64;arm
	321	+pselect6_time64;arm
	322	+ppoll_time64;arm
	323	+recvmmsg_time64;arm
	324	+semtimedop_time64;arm
	325	+rt_sigtimedwait_time64;arm
	326	+futex_time64;arm
	327	+sched_rr_get_interval_time64;arm
	328	+cacheflush;arm
	329	+set_tls;arm
	330	+
	331	+@allowListWithArgs
	332	+clone: if (arg0 & (CLONE_NEWNS \| CLONE_NEWPID \| CLONE_NEWNET \| CLONE_NEWCGROUP \| CLONE_NEWUTS \| CLONE_NEWIPC \| CLONE_NEWUSER)) == 0 ; return ALLOW; else return TRAP;all

Mtest/unittest/BUILD.gn+4-0

	@@ -205,6 +205,10 @@ ohos_unittest("init_unittest") {
205	if (init_feature_seccomp_privilege) {	205	if (init_feature_seccomp_privilege) {
206	defines += [ "SECCOMP_PRIVILEGE" ]	206	defines += [ "SECCOMP_PRIVILEGE" ]
207	}	207	}
		208	+
		209	+ if (init_feature_custom_sandbox) {
		210	+ defines += [ "CUSTOM_SANDBOX" ]
		211	+ }
208	}	212	}
209		213
210	sources += [	214	sources += [

Mtest/unittest/seccomp/seccomp_unittest.cpp+28-0

	@@ -703,6 +703,7 @@ public:
703	ret = CheckSyscall(APP, APP_NAME, CheckGetpid, true);	703	ret = CheckSyscall(APP, APP_NAME, CheckGetpid, true);
704	EXPECT_EQ(ret, 0);	704	EXPECT_EQ(ret, 0);
705	}	705	}
		706	+
706	#ifdef SECCOMP_PRIVILEGE	707	#ifdef SECCOMP_PRIVILEGE
707	void TestSeccompPrivilegeSyscall()	708	void TestSeccompPrivilegeSyscall()
708	{	709	{
	@@ -711,6 +712,19 @@ public:
711	}	712	}
712	#endif	713	#endif
713		714
		715	+#ifdef CUSTOM_SANDBOX
		716	+ void TestSeccompCustomSyscall()
		717	+ {
		718	+ // app custom allowlist
		719	+ ret = CheckSyscall(APP, APP_CUSTOM, CheckGetpid, true);
		720	+ EXPECT_EQ(ret, 0);
		721	+
		722	+ // app custom blocklist
		723	+ int ret = CheckSyscall(APP, APP_CUSTOM, CheckSetuid, false);
		724	+ EXPECT_EQ(ret, 0);
		725	+ }
		726	+#endif
		727	+
714	#elif defined __arm__	728	#elif defined __arm__
715	static bool CheckGetuid32()	729	static bool CheckGetuid32()
716	{	730	{
	@@ -1346,4 +1360,18 @@ HWTEST_F(SeccompUnitTest, Init_Seccomp_SeccompPrivilegeSycall001, TestSize.Level
1346	test.TestSeccompPrivilegeSyscall();	1360	test.TestSeccompPrivilegeSyscall();
1347	}	1361	}
1348	#endif	1362	#endif
		1363	+
		1364	+#ifdef CUSTOM_SANDBOX
		1365	+/**
		1366	+ * @tc.name: TestSeccompCustomSyscall
		1367	+ * @tc.desc: Verify the custom syscall of app and appspawn.
		1368	+ * @tc.type: FUNC
		1369	+ * @tc.require: issueIBP64F
		1370	+ */
		1371	+HWTEST_F(SeccompUnitTest, Init_Seccomp_SeccompCustomSycall001, TestSize.Level1)
		1372	+{
		1373	+ SeccompUnitTest test;
		1374	+ test.TestSeccompCustomSyscall();
		1375	+}
		1376	+#endif
1349	}	1377	}