deny.c

static bool setup_default_deny(bool can_exec, scmp_filter_ctx ctx) {
	ALLOW_CALL(rt_sigprocmask);
	ALLOW_CALL(poll);
	ALLOW_CALL(prctl);

	ALLOW_CALL(_llseek);
	ALLOW_CALL(accept);
	ALLOW_CALL(arch_prctl);
	ALLOW_CALL(bind);
	ALLOW_CALL(brk);
	ALLOW_CALL(cacheflush);
	ALLOW_CALL(clock_getres);
	ALLOW_CALL(clock_getres_time64);
	ALLOW_CALL(clock_gettime);
	ALLOW_CALL(clock_gettime64);
	ALLOW_CALL(clock_nanosleep);
	ALLOW_CALL(clock_nanosleep_time64);
	ALLOW_CALL(close);
	ALLOW_CALL(connect);
	ALLOW_CALL(dup);
	ALLOW_CALL(dup2);
	ALLOW_CALL(dup3);
	ALLOW_CALL(execve);
	ALLOW_CALL(exit);
	ALLOW_CALL(exit_group);
	ALLOW_CALL(fcntl);
	ALLOW_CALL(fstat);
	ALLOW_CALL(fstat64);
	ALLOW_CALL(futex);
	ALLOW_CALL(futex_time64);
	ALLOW_CALL(get_robust_list);
	ALLOW_CALL(get_thread_area);
	ALLOW_CALL(getcwd);
	ALLOW_CALL(getdents);
	ALLOW_CALL(getdents64);
	ALLOW_CALL(getegid);
	ALLOW_CALL(getegid32);
	ALLOW_CALL(geteuid);
	ALLOW_CALL(geteuid32);
	ALLOW_CALL(getgid);
	ALLOW_CALL(getgid32);
	ALLOW_CALL(getgroups);
	ALLOW_CALL(getgroups32);
	ALLOW_CALL(getpgid);
	ALLOW_CALL(getpgrp);
	ALLOW_CALL(getpid);
	ALLOW_CALL(getppid);
	ALLOW_CALL(getrandom);
	ALLOW_CALL(getresgid);
	ALLOW_CALL(getresgid32);
	ALLOW_CALL(getresuid);
	ALLOW_CALL(getresuid32);
	ALLOW_CALL(getrlimit);
	ALLOW_CALL(getsid);
	ALLOW_CALL(getsockname);
	ALLOW_CALL(getsockopt);
	ALLOW_CALL(gettid);
	ALLOW_CALL(gettimeofday);
	ALLOW_CALL(getuid);
	ALLOW_CALL(getuid32);
	ALLOW_CALL(getxattr);
	ALLOW_CALL(listen);
	ALLOW_CALL(lseek);
	ALLOW_CALL(madvise);
	ALLOW_CALL(membarrier);
	ALLOW_CALL(mmap);
	ALLOW_CALL(mmap2);
	ALLOW_CALL(mprotect);
	ALLOW_CALL(mremap);
	ALLOW_CALL(munmap);
	ALLOW_CALL(nanosleep);
	ALLOW_CALL(openat);
	ALLOW_CALL(pause);
	ALLOW_CALL(pipe2);
	ALLOW_CALL(preadv);
	ALLOW_CALL(preadv2);
	ALLOW_CALL(pwrite64);
	ALLOW_CALL(pwritev);
	ALLOW_CALL(pwritev2);
	ALLOW_CALL(read);
	ALLOW_CALL(readv);
	ALLOW_CALL(recv);
	ALLOW_CALL(recvfrom);
	ALLOW_CALL(recvmmsg);
	ALLOW_CALL(recvmsg);
	ALLOW_CALL(restart_syscall);
	ALLOW_CALL(rseq);
	ALLOW_CALL(rt_sigaction);
	ALLOW_CALL(rt_sigreturn);
	ALLOW_CALL(sched_getaffinity);
	ALLOW_CALL(sched_yield);
	ALLOW_CALL(send);
	ALLOW_CALL(sendto);
	ALLOW_CALL(set_robust_list);
	ALLOW_CALL(set_thread_area);
	ALLOW_CALL(set_tid_address);
	ALLOW_CALL(set_tls);
	ALLOW_CALL(setsockopt);
	ALLOW_CALL(shutdown);
	ALLOW_CALL(sigreturn);
	ALLOW_CALL(socket);
	ALLOW_CALL(time);
	ALLOW_CALL(ugetrlimit);
	ALLOW_CALL(uname);
	ALLOW_CALL(unlink);
	ALLOW_CALL(wait4);
	ALLOW_CALL(write);
	ALLOW_CALL(writev);

#ifdef __NR_pread64
    ALLOW_CALL(pread64);
#endif
#ifdef __NR_prlimit64
    ALLOW_CALL(prlimit64);
#endif
#ifdef __NR_newfstatat
	ALLOW_CALL(newfstatat);
#endif
#ifdef HAVE_SYS_EPOLL_H
	ALLOW_CALL(epoll_ctl);
	ALLOW_CALL(epoll_wait);
#else
	ALLOW_CALL(select);
#endif

//    ALLOW_CALL(ioctl);

	ALLOW_IOCTL(TUNSETIFF);
	ALLOW_IOCTL(FIONREAD);
	ALLOW_IOCTL(SIOCGIFHWADDR);
	ALLOW_IOCTL(TIOCGWINSZ); // musl (stdout)
	ALLOW_IOCTL(TCGETS); // glibc (stdout)

	if(can_exec) {
		ALLOW_CALL(clone);
		ALLOW_CALL(clone3);
		ALLOW_CALL(execve);
		ALLOW_CALL(fork);
		ALLOW_CALL(vfork);
	}

	return true;
}