System calls allowed by CodeSafe 5 applications

CodeSafe 5 applications are restricted to a subset of Linux system calls (syscalls) which they are permitted to execute.

Denied System Calls

Any denied syscalls fail by returning -1 and setting errno to the value 38, which denotes ENOSYS (Function not implemented). This behavior applies in v13.7 firmware and later; before this, the SIGSYS signal was raised instead when a denied syscall was attempted.

Denying with ENOSYS (rather than raising a signal) allows applications to fall back gracefully to allowed alternative syscalls.

Library code (including the C library itself) often supports several alternative syscalls for an operation to maintain compatibility across platforms and kernel versions.

This enables security restrictions to be enforced while making it more likely that general-purpose library or application code can work with minimal modification in the restricted CodeSafe environment.

For example, the getrandom syscall is not supported in CodeSafe 5 and will fail with ENOSYS. This prevents applications from accidentally using the Linux kernel’s non-HSM RNG.

Use either the Cmd_GenerateRandom nCore command, or /dev/random or /dev/urandom within the CodeSafe 5 application in order to obtain HSM RNG instead. Many libraries fall back to /dev/random or /dev/urandom if the getrandom syscall (or the getentropy C library wrapper, which uses getrandom) fails with ENOSYS, allowing them to continue working without modification while still using the HSM-backed RNG.

If a library does not automatically fall back, configure it explicitly to use /dev/random. The /dev/random device is always seeded and fully initialized before the CodeSafe 5 application container starts.

When cross-compiling recent versions of OpenSSL, pass --with-rand-seed=devrandom to the Configure script to ensure /dev/random is used. OpenSSL no longer falls back automatically when getentropy returns ENOSYS, so this option is required to avoid runtime failures.

Allowed System Calls

The table below lists all system calls allowed in CodeSafe 5 applications, including each syscall number, name, a link to the Linux documentation page, a broad operation category, and the firmware version in which it was first allowed in CodeSafe 5.

Syscall Number	Syscall Name	Category	Comment
1	exit	Process Management: Process Creation & Termination	Allowed in CodeSafe 5 since v13.4
2	fork	Process Management: Process Creation & Termination	Allowed in CodeSafe 5 since v13.4
3	read	File System: Read/Write Operations	Allowed in CodeSafe 5 since v13.4
4	write	File System: Read/Write Operations	Allowed in CodeSafe 5 since v13.4
5	open	File System: File Descriptor & Control Operations	Allowed in CodeSafe 5 since v13.4
6	close	File System: File Descriptor & Control Operations	Allowed in CodeSafe 5 since v13.4
7	waitpid	Process Management: Process Creation & Termination	Allowed in CodeSafe 5 since v13.4
8	creat	File System: File Descriptor & Control Operations	Allowed in CodeSafe 5 since v13.4
9	link	File System: File Links and Symlinks	Allowed in CodeSafe 5 since v13.4
10	unlink	File System: File Links and Symlinks	Allowed in CodeSafe 5 since v13.4
11	execve	Process Management: Process Creation & Termination	Allowed in CodeSafe 5 since v13.4
12	chdir	File System: Directory Operations	Allowed in CodeSafe 5 since v13.4
13	time	Time & Timers: System Time Access & Adjustment	Allowed in CodeSafe 5 since v13.4
15	chmod	File System: Access Control and Permissions	Allowed in CodeSafe 5 since v13.4
16	lchown	File System: Access Control and Permissions	Allowed in CodeSafe 5 since v13.7
19	lseek	File System: File Descriptor & Control Operations	Allowed in CodeSafe 5 since v13.4
20	getpid	Process Management: Process Lifecycle & Waiting	Allowed in CodeSafe 5 since v13.4
24	getuid	Resource Control & Permissions: User & Group Identifiers	Allowed in CodeSafe 5 since v13.4
27	alarm	Time & Timers: Timers & Sleep Functions	Allowed in CodeSafe 5 since v13.7
29	pause	Process Management: Process Lifecycle & Waiting	Allowed in CodeSafe 5 since v13.4
30	utime	File System: Metadata & Filesystem Attributes	Allowed in CodeSafe 5 since v13.7
33	access	File System: Access Control and Permissions	Allowed in CodeSafe 5 since v13.4
34	nice	Process Management: Scheduling & Prioritization	Allowed in CodeSafe 5 since v13.7 (to reduce priority only)
36	sync	File System: Filesystem Synchronization	Allowed in CodeSafe 5 since v13.4
37	kill	Process Management: Signal Handling	Allowed in CodeSafe 5 since v13.4
38	rename	File System: Directory Operations	Allowed in CodeSafe 5 since v13.4
39	mkdir	File System: Directory Operations	Allowed in CodeSafe 5 since v13.4
40	rmdir	File System: Directory Operations	Allowed in CodeSafe 5 since v13.4
41	dup	File System: File Descriptor & Control Operations	Allowed in CodeSafe 5 since v13.4
42	pipe	Inter-Process Communication: Shared Memory, Pipes & Events	Allowed in CodeSafe 5 since v13.4
43	times	Resource Control & Permissions: Resource Limits	Allowed in CodeSafe 5 since v13.7
45	brk	Memory Management: Memory Management Operations	Allowed in CodeSafe 5 since v13.4
47	getgid	Resource Control & Permissions: User & Group Identifiers	Allowed in CodeSafe 5 since v13.4
49	geteuid	Resource Control & Permissions: User & Group Identifiers	Allowed in CodeSafe 5 since v13.4
50	getegid	Resource Control & Permissions: User & Group Identifiers	Allowed in CodeSafe 5 since v13.4
54	ioctl	Device Control: Character Device Operations	Allowed in CodeSafe 5 since v13.4
55	fcntl	File System: File Descriptor & Control Operations	Allowed in CodeSafe 5 since v13.4
57	setpgid	Resource Control & Permissions: Session & Group Management	Allowed in CodeSafe 5 since v13.7
60	umask	File System: Access Control and Permissions	Allowed in CodeSafe 5 since v13.4
63	dup2	File System: File Descriptor & Control Operations	Allowed in CodeSafe 5 since v13.4
64	getppid	Resource Control & Permissions: Session & Group Management	Allowed in CodeSafe 5 since v13.4
65	getpgrp	Resource Control & Permissions: Session & Group Management	Allowed in CodeSafe 5 since v13.4
66	setsid	Resource Control & Permissions: Session & Group Management	Allowed in CodeSafe 5 since v13.4
75	setrlimit	Resource Control & Permissions: Resource Limits	Allowed in CodeSafe 5 since v13.7 (to reduce resource limits only)
77	getrusage	Resource Control & Permissions: Resource Limits	Allowed in CodeSafe 5 since v13.7
78	gettimeofday	Time & Timers: System Time Access & Adjustment	Allowed in CodeSafe 5 since v13.4
80	getgroups	Resource Control & Permissions: Session & Group Management	Allowed in CodeSafe 5 since v13.5
83	symlink	File System: File Links and Symlinks	Allowed in CodeSafe 5 since v13.4
85	readlink	File System: File Links and Symlinks	Allowed in CodeSafe 5 since v13.4
88	reboot	Process Management: Process Control	Allowed in CodeSafe 5 since v13.4
90	mmap	Memory Management: Memory Mapping	Allowed in CodeSafe 5 since v13.4
91	munmap	Memory Management: Memory Mapping	Allowed in CodeSafe 5 since v13.4
92	truncate	File System: Metadata & Filesystem Attributes	Allowed in CodeSafe 5 since v13.7
93	ftruncate	File System: Metadata & Filesystem Attributes	Allowed in CodeSafe 5 since v13.7
94	fchmod	File System: Access Control and Permissions	Allowed in CodeSafe 5 since v13.4
95	fchown	File System: Access Control and Permissions	Allowed in CodeSafe 5 since v13.7
96	getpriority	Process Management: Scheduling & Prioritization	Allowed in CodeSafe 5 since v13.5
97	setpriority	Process Management: Scheduling & Prioritization	Allowed in CodeSafe 5 since v13.7 (to reduce priority only)
99	statfs	File System: Metadata & Filesystem Attributes	Allowed in CodeSafe 5 since v13.4
100	fstatfs	File System: Metadata & Filesystem Attributes	Allowed in CodeSafe 5 since v13.7
102	socketcall	Networking & Socket Operations: Socket Management & Data Transfer	Allowed in CodeSafe 5 since v13.4
104	setitimer	Time & Timers: Timers & Sleep Functions	Allowed in CodeSafe 5 since v13.7
105	getitimer	Time & Timers: Timers & Sleep Functions	Allowed in CodeSafe 5 since v13.7
106	stat	File System: Metadata & Filesystem Attributes	Allowed in CodeSafe 5 since v13.4
107	lstat	File System: Metadata & Filesystem Attributes	Allowed in CodeSafe 5 since v13.4
108	fstat	File System: Metadata & Filesystem Attributes	Allowed in CodeSafe 5 since v13.4
114	wait4	Process Management: Process Creation & Termination	Allowed in CodeSafe 5 since v13.4
117	ipc	Inter-Process Communication: Compatibility Interfaces	Allowed in CodeSafe 5 since v13.5
118	fsync	File System: Filesystem Synchronization	Allowed in CodeSafe 5 since v13.7
120	clone	Process Management: Process Creation & Termination	Allowed in CodeSafe 5 since v13.4
122	uname	Miscellaneous System Functions: Utility & System Info	Allowed in CodeSafe 5 since v13.4
125	mprotect	Memory Management: Memory Mapping	Allowed in CodeSafe 5 since v13.4
132	getpgid	Resource Control & Permissions: Session & Group Management	Allowed in CodeSafe 5 since v13.7
133	fchdir	File System: Directory Operations	Allowed in CodeSafe 5 since v13.7
140	_llseek	File System: File Descriptor & Control Operations	Allowed in CodeSafe 5 since v13.4
141	getdents	File System: Directory Operations	Allowed in CodeSafe 5 since v13.4
142	_newselect	Networking & Socket Operations: I/O Multiplexing & Readiness	Allowed in CodeSafe 5 since v13.7
143	flock	File System: File Descriptor & Control Operations	Allowed in CodeSafe 5 since v13.7
144	msync	Memory Management: Memory Mapping	Allowed in CodeSafe 5 since v13.7
145	readv	File System: Read/Write Operations	Allowed in CodeSafe 5 since v13.4
146	writev	File System: Read/Write Operations	Allowed in CodeSafe 5 since v13.4
147	getsid	Resource Control & Permissions: Session & Group Management	Allowed in CodeSafe 5 since v13.7
148	fdatasync	File System: Filesystem Synchronization	Allowed in CodeSafe 5 since v13.7
158	sched_yield	Process Management: Scheduling & Prioritization	Allowed in CodeSafe 5 since v13.7
162	nanosleep	Time & Timers: Timers & Sleep Functions	Allowed in CodeSafe 5 since v13.4
163	mremap	Memory Management: Memory Mapping	Allowed in CodeSafe 5 since v13.4
167	poll	Networking & Socket Operations: I/O Multiplexing & Readiness	Allowed in CodeSafe 5 since v13.4
172	rt_sigreturn	Process Management: Signal Handling	Allowed in CodeSafe 5 since v13.4
173	rt_sigaction	Process Management: Signal Handling	Allowed in CodeSafe 5 since v13.4
174	rt_sigprocmask	Process Management: Signal Handling	Allowed in CodeSafe 5 since v13.4
175	rt_sigpending	Process Management: Signal Handling	Allowed in CodeSafe 5 since v13.4
176	rt_sigtimedwait	Process Management: Signal Handling	Allowed in CodeSafe 5 since v13.4
177	rt_sigqueueinfo	Process Management: Signal Handling	Allowed in CodeSafe 5 since v13.4
178	rt_sigsuspend	Process Management: Signal Handling	Allowed in CodeSafe 5 since v13.4
179	pread64	File System: Read/Write Operations	Allowed in CodeSafe 5 since v13.4
180	pwrite64	File System: Read/Write Operations	Allowed in CodeSafe 5 since v13.7
181	chown	File System: Access Control and Permissions	Allowed in CodeSafe 5 since v13.4
182	getcwd	File System: Directory Operations	Allowed in CodeSafe 5 since v13.4
185	sigaltstack	Process Management: Signal Handling	Allowed in CodeSafe 5 since v13.4
186	sendfile	File System: Read/Write Operations	Allowed in CodeSafe 5 since v13.7
190	ugetrlimit	Resource Control & Permissions: Resource Limits	Allowed in CodeSafe 5 since v13.4
202	getdents64	File System: Directory Operations	Allowed in CodeSafe 5 since v13.4
205	madvise	Memory Management: Memory Mapping	Allowed in CodeSafe 5 since v13.4
207	gettid	Process Management: Process Lifecycle & Waiting	Allowed in CodeSafe 5 since v13.4
208	tkill	Process Management: Signal Handling	Allowed in CodeSafe 5 since v13.5
221	futex	Process Management: Synchronization	Allowed in CodeSafe 5 since v13.4
232	set_tid_address	Process Management: Thread/Process Context Operations	Allowed in CodeSafe 5 since v13.4
234	exit_group	Process Management: Process Creation & Termination	Allowed in CodeSafe 5 since v13.4
236	epoll_create	File System: File Descriptor & Control Operations	Allowed in CodeSafe 5 since v13.7
237	epoll_ctl	File System: File Descriptor & Control Operations	Allowed in CodeSafe 5 since v13.7
238	epoll_wait	File System: File Descriptor & Control Operations	Allowed in CodeSafe 5 since v13.7
246	clock_gettime	Time & Timers: Clock Management & Resolution	Allowed in CodeSafe 5 since v13.4
247	clock_getres	Time & Timers: Clock Management & Resolution	Allowed in CodeSafe 5 since v13.7
248	clock_nanosleep	Time & Timers: Clock Management & Resolution	Allowed in CodeSafe 5 since v13.7
250	tgkill	Process Management: Signal Handling	Allowed in CodeSafe 5 since v13.4
251	utimes	File System: Metadata & Filesystem Attributes	Allowed in CodeSafe 5 since v13.7
252	statfs64	File System: Metadata & Filesystem Attributes	Allowed in CodeSafe 5 since v13.4
253	fstatfs64	File System: Metadata & Filesystem Attributes	Allowed in CodeSafe 5 since v13.7
272	waitid	Process Management: Process Creation & Termination	Allowed in CodeSafe 5 since v13.7
280	pselect6	Networking & Socket Operations: I/O Multiplexing & Readiness	Allowed in CodeSafe 5 since v13.7
281	ppoll	Networking & Socket Operations: I/O Multiplexing & Readiness	Allowed in CodeSafe 5 since v13.4
286	openat	File System: Metadata & Filesystem Attributes	Allowed in CodeSafe 5 since v13.4
287	mkdirat	File System: Metadata & Filesystem Attributes	Allowed in CodeSafe 5 since v13.7
289	fchownat	File System: Metadata & Filesystem Attributes	Allowed in CodeSafe 5 since v13.7
291	newfstatat	File System: Metadata & Filesystem Attributes	Allowed in CodeSafe 5 since v13.7
292	unlinkat	File System: Metadata & Filesystem Attributes	Allowed in CodeSafe 5 since v13.7
293	renameat	File System: Metadata & Filesystem Attributes	Allowed in CodeSafe 5 since v13.7
294	linkat	File System: Metadata & Filesystem Attributes	Allowed in CodeSafe 5 since v13.7
295	symlinkat	File System: Metadata & Filesystem Attributes	Allowed in CodeSafe 5 since v13.7
296	readlinkat	File System: Metadata & Filesystem Attributes	Allowed in CodeSafe 5 since v13.7
297	fchmodat	File System: Metadata & Filesystem Attributes	Allowed in CodeSafe 5 since v13.7
298	faccessat	File System: File Descriptor & Control Operations	Allowed in CodeSafe 5 since v13.7
303	epoll_pwait	File System: File Descriptor & Control Operations	Allowed in CodeSafe 5 since v13.7
304	utimensat	File System: Metadata & Filesystem Attributes	Allowed in CodeSafe 5 since v13.5
307	eventfd	Inter-Process Communication: Shared Memory, Pipes & Events	Allowed in CodeSafe 5 since v13.7
309	fallocate	File System: File Descriptor & Control Operations	Allowed in CodeSafe 5 since v13.7
315	epoll_create1	File System: File Descriptor & Control Operations	Allowed in CodeSafe 5 since v13.5
316	dup3	File System: File Descriptor & Control Operations	Allowed in CodeSafe 5 since v13.7
317	pipe2	Inter-Process Communication: Shared Memory, Pipes & Events	Allowed in CodeSafe 5 since v13.7
320	preadv	File System: Read/Write Operations	Allowed in CodeSafe 5 since v13.7
321	pwritev	File System: Read/Write Operations	Allowed in CodeSafe 5 since v13.7
322	rt_tgsigqueueinfo	Process Management: Signal Handling	Allowed in CodeSafe 5 since v13.7
325	prlimit64	Resource Control & Permissions: Resource Limits	Allowed in CodeSafe 5 since v13.7 (to reduce resource limits only)
326	socket	Networking & Socket Operations: Socket Management & Data Transfer	Allowed in CodeSafe 5 since v13.4
327	bind	Networking & Socket Operations: Socket Management & Data Transfer	Allowed in CodeSafe 5 since v13.4
328	connect	Networking & Socket Operations: Socket Management & Data Transfer	Allowed in CodeSafe 5 since v13.4
329	listen	Networking & Socket Operations: Socket Management & Data Transfer	Allowed in CodeSafe 5 since v13.4
330	accept	Networking & Socket Operations: Socket Management & Data Transfer	Allowed in CodeSafe 5 since v13.4
331	getsockname	Networking & Socket Operations: Socket Management & Data Transfer	Allowed in CodeSafe 5 since v13.4
332	getpeername	Networking & Socket Operations: Socket Management & Data Transfer	Allowed in CodeSafe 5 since v13.4
333	socketpair	Networking & Socket Operations: Socket Management & Data Transfer	Allowed in CodeSafe 5 since v13.4
334	send	Networking & Socket Operations: Socket Management & Data Transfer	Allowed in CodeSafe 5 since v13.4
335	sendto	Networking & Socket Operations: Socket Management & Data Transfer	Allowed in CodeSafe 5 since v13.4
336	recv	Networking & Socket Operations: Socket Management & Data Transfer	Allowed in CodeSafe 5 since v13.4
337	recvfrom	Networking & Socket Operations: Socket Management & Data Transfer	Allowed in CodeSafe 5 since v13.4
338	shutdown	Networking & Socket Operations: Socket Management & Data Transfer	Allowed in CodeSafe 5 since v13.4
339	setsockopt	Networking & Socket Operations: Socket Management & Data Transfer	Allowed in CodeSafe 5 since v13.4
340	getsockopt	Networking & Socket Operations: Socket Management & Data Transfer	Allowed in CodeSafe 5 since v13.4
341	sendmsg	Networking & Socket Operations: Socket Management & Data Transfer	Allowed in CodeSafe 5 since v13.4
342	recvmsg	Networking & Socket Operations: Socket Management & Data Transfer	Allowed in CodeSafe 5 since v13.4
343	recvmmsg	Networking & Socket Operations: Socket Management & Data Transfer	Allowed in CodeSafe 5 since v13.4
344	accept4	Networking & Socket Operations: Socket Management & Data Transfer	Allowed in CodeSafe 5 since v13.4
348	syncfs	File System: Filesystem Synchronization	Allowed in CodeSafe 5 since v13.7
349	sendmmsg	Networking & Socket Operations: Socket Management & Data Transfer	Allowed in CodeSafe 5 since v13.4
357	renameat2	File System: Metadata & Filesystem Attributes	Allowed in CodeSafe 5 since v13.7
362	execveat	Process Management: Process Creation & Termination	Allowed in CodeSafe 5 since v13.7
365	membarrier	Process Management: Synchronization	Allowed in CodeSafe 5 since v13.4
380	preadv2	File System: Read/Write Operations	Allowed in CodeSafe 5 since v13.7
381	pwritev2	File System: Read/Write Operations	Allowed in CodeSafe 5 since v13.7
383	statx	File System: Metadata & Filesystem Attributes	Allowed in CodeSafe 5 since v13.7

Syscall Number

Syscall Name