prefetcher: add seccomp with libminijail
Install a seccomp filter to further tighten down security access
for iorap.prefetcherd
Bug: 144299141
Test: manual (check logcat for no failures)
Change-Id: Ia05e3dafb2e90b91f8b37fa0a0380037f7d9b3c0
diff --git a/seccomp_policy/prefetcherd.arm64.policy b/seccomp_policy/prefetcherd.arm64.policy
new file mode 100644
index 0000000..a796ad1
--- /dev/null
+++ b/seccomp_policy/prefetcherd.arm64.policy
@@ -0,0 +1,21 @@
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# main usage: fadvise to prefetch data
+fadvise64: 1
+
+# bionic's fdsan requires this
+getrlimit: 1
+
+@include /system/etc/seccomp_policy/crash_dump.arm64.policy