Expand description
Syscall-allowlist node for the canonical policy AST (AAASM-3624).
A SyscallAllowlist is a per-workload set of permitted syscalls. It lives
on the same PolicyDocument as the
path/egress rules so the kernel-layer syscall allowlist is expressed in the
ONE policy source — there is no second policy path. The AAASM-3635 lowering
compiles this node into the SYSCALL_ALLOWLIST eBPF map entries the
AAASM-3631 enforcement probe consumes.
Naming mirrors the lowercase syscall names used elsewhere
(aa-ebpf::syscall::SyscallKind) so a policy reads read / write /
close, not raw numbers. Each known name carries its x86_64 syscall number
for the lowering step. Unknown names are rejected at parse/validation time
so a typo cannot silently widen the allowlist.
Structs§
- Syscall
Allowlist - A per-workload kernel syscall allowlist node on the canonical policy AST.
Enums§
- Syscall
- A syscall permitted by a
SyscallAllowlist.