seccomp: make consistent use of faccessat/2
In some places the faccessat and faccessat2 syscalls were
added only for arm64 but starting with glibc 2.33 they are
required on all architectures, so add them to arm and amd64.
BUG=b:187795855
TEST=Local builds; CQ.
Change-Id: Ia4c215ead59f8c1b264383f9bc07461dddf202c1
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/touch_updater/+/3110378
Reviewed-by: Andrew de los Reyes <adlr@chromium.org>
Reviewed-by: Manoj Gupta <manojgupta@chromium.org>
Tested-by: Manoj Gupta <manojgupta@chromium.org>
Commit-Queue: Manoj Gupta <manojgupta@chromium.org>
diff --git a/policies/amd64/rmi4update.query.policy b/policies/amd64/rmi4update.query.policy
index fd30389..7da0172 100644
--- a/policies/amd64/rmi4update.query.policy
+++ b/policies/amd64/rmi4update.query.policy
@@ -24,6 +24,8 @@
close: 1
open: 1
openat: 1
+faccessat: 1
+faccessat2: 1
mprotect: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE
fstat: 1
newfstatat: 1
diff --git a/policies/amd64/rmi4update.update.policy b/policies/amd64/rmi4update.update.policy
index 98dbb1a..8d3e710 100644
--- a/policies/amd64/rmi4update.update.policy
+++ b/policies/amd64/rmi4update.update.policy
@@ -17,6 +17,8 @@
ioctl: 1
open: 1
openat: 1
+faccessat: 1
+faccessat2: 1
mprotect: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE
clock_gettime: 1
brk: 1
diff --git a/policies/amd64/wacom_flash.query.policy b/policies/amd64/wacom_flash.query.policy
index 442344b..c391a87 100644
--- a/policies/amd64/wacom_flash.query.policy
+++ b/policies/amd64/wacom_flash.query.policy
@@ -20,6 +20,8 @@
rt_sigreturn: 1
exit_group: 1
read: 1
+faccessat: 1
+faccessat2: 1
arch_prctl: 1
access: 1
munmap: 1
diff --git a/policies/amd64/wacom_flash.update.policy b/policies/amd64/wacom_flash.update.policy
index 66a784b..cb59162 100644
--- a/policies/amd64/wacom_flash.update.policy
+++ b/policies/amd64/wacom_flash.update.policy
@@ -23,6 +23,8 @@
open: 1
openat: 1
read: 1
+faccessat: 1
+faccessat2: 1
restart_syscall: 1
rt_sigreturn: 1
stat: 1
diff --git a/policies/arm/rmi4update.query.policy b/policies/arm/rmi4update.query.policy
index f36d944..708677b 100644
--- a/policies/arm/rmi4update.query.policy
+++ b/policies/arm/rmi4update.query.policy
@@ -23,6 +23,8 @@
close: 1
open: 1
openat: 1
+faccessat: 1
+faccessat2: 1
mprotect: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE
fstat64: 1
execve: 1
diff --git a/policies/arm/rmi4update.update.policy b/policies/arm/rmi4update.update.policy
index 2c23b6e..160c584 100644
--- a/policies/arm/rmi4update.update.policy
+++ b/policies/arm/rmi4update.update.policy
@@ -17,6 +17,8 @@
ioctl: 1
open: 1
openat: 1
+faccessat: 1
+faccessat2: 1
brk: 1
_llseek: 1
readlink: 1
diff --git a/policies/arm/wacom_flash.query.policy b/policies/arm/wacom_flash.query.policy
index 2ea2dc0..1f9e118 100644
--- a/policies/arm/wacom_flash.query.policy
+++ b/policies/arm/wacom_flash.query.policy
@@ -22,6 +22,8 @@
exit_group: 1
ARM_set_tls: 1
read: 1
+faccessat: 1
+faccessat2: 1
uname: 1
munmap: 1
brk: 1
diff --git a/policies/arm/wacom_flash.update.policy b/policies/arm/wacom_flash.update.policy
index af833fc..15c2fc8 100644
--- a/policies/arm/wacom_flash.update.policy
+++ b/policies/arm/wacom_flash.update.policy
@@ -17,6 +17,8 @@
mmap2: 1
fstat64: 1
fstatat64: 1
+faccessat: 1
+faccessat2: 1
mprotect: 1
close: 1
ioctl: arg1 == 0x706 || arg1 == 0x707
