Browse Source

seccomp: add set_mempolicy_home_node syscall (kernel v5.17, libseccomp v2.5.4)

This syscall is gated by CAP_SYS_NICE, matching the profile in containerd.

containerd: https://github.com/containerd/containerd/commit/a6e52c74fa043a63d7dae4ac6998215f6c1bb6ac
libseccomp: https://github.com/seccomp/libseccomp/commit/d83cb7ac252db91e9ca9c372ea4743e02ba97c50
kernel: https://github.com/torvalds/linux/commit/c6018b4b254971863bd0ad36bb5e7d0fa0f0ddb0

    mm/mempolicy: add set_mempolicy_home_node syscall
    This syscall can be used to set a home node for the MPOL_BIND and
    MPOL_PREFERRED_MANY memory policy.  Users should use this syscall after
    setting up a memory policy for the specified range as shown below.

      mbind(p, nr_pages * page_size, MPOL_BIND, new_nodes->maskp,
            new_nodes->size + 1, 0);
      sys_set_mempolicy_home_node((unsigned long)p, nr_pages * page_size,
                    home_node, 0);

    The syscall allows specifying a home node/preferred node from which
    kernel will fulfill memory allocation requests first.
    ...

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 1251982cf7a079c97d4e67cfd69d4e03ab55edc7)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Sebastiaan van Stijn 1 year ago
parent
commit
61b82be580
2 changed files with 3 additions and 1 deletions
  1. 2 1
      profiles/seccomp/default.json
  2. 1 0
      profiles/seccomp/default_linux.go

+ 2 - 1
profiles/seccomp/default.json

@@ -780,7 +780,8 @@
 			"names": [
 			"names": [
 				"get_mempolicy",
 				"get_mempolicy",
 				"mbind",
 				"mbind",
-				"set_mempolicy"
+				"set_mempolicy",
+				"set_mempolicy_home_node"
 			],
 			],
 			"action": "SCMP_ACT_ALLOW",
 			"action": "SCMP_ACT_ALLOW",
 			"includes": {
 			"includes": {

+ 1 - 0
profiles/seccomp/default_linux.go

@@ -768,6 +768,7 @@ func DefaultProfile() *Seccomp {
 					"get_mempolicy",
 					"get_mempolicy",
 					"mbind",
 					"mbind",
 					"set_mempolicy",
 					"set_mempolicy",
+					"set_mempolicy_home_node", // kernel v5.17, libseccomp v2.5.4
 				},
 				},
 				Action: specs.ActAllow,
 				Action: specs.ActAllow,
 			},
 			},