0ct0pu5/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

profiles: seccomp: add syscalls related to PKU in default policy

Browse source 
Add pkey_alloc(2), pkey_free(2) and pkey_mprotect(2) in seccomp default profile.
pkey_alloc(2), pkey_free(2) and pkey_mprotect(2) can only configure
the calling process's own memory, so they are existing "safe for everyone" syscalls.

close issue: #43481

Signed-off-by: zhubojun <bojun.zhu@foxmail.com>
(cherry picked from commit e258d66f17)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This commit is contained in:
zhubojun 2022-04-15 11:29:11 +08:00 • committed by Sebastiaan van Stijn
parent 6408132d74
commit edcc51cbee
No known key found for this signature in database
GPG key ID: 76698F39D527CE8C
2 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
profiles/seccomp/default.json
View file

@ -248,6 +248,9 @@
"pidfd_send_signal",
"pipe",
"pipe2",
"pkey_alloc",
"pkey_free",
"pkey_mprotect",
"poll",
"ppoll",
"ppoll_time64",

3
profiles/seccomp/default_linux.go
View file

@ -240,6 +240,9 @@ func DefaultProfile() *Seccomp {
"pidfd_send_signal",
"pipe",
"pipe2",
"pkey_alloc",
"pkey_free",
"pkey_mprotect",
"poll",
"ppoll",
"ppoll_time64",