beenull/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge pull request #47345 from thaJeztah/24.0_backport_seccomp_updates

Browse source 
[24.0 backport] profiles/seccomp: add syscalls for kernel v5.17 - v6.6, match containerd's profile
This commit is contained in:
Akihiro Suda 2024-02-07 19:48:11 +09:00 committed by GitHub
commit f11b55ffec
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 15 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
profiles/seccomp/default.json
View file

@ -64,6 +64,7 @@
"alarm",
"bind",
"brk",
"cachestat",
"capget",
"capset",
"chdir",
@ -109,6 +110,7 @@
"fchdir",
"fchmod",
"fchmodat",
"fchmodat2",
"fchown",
"fchown32",
"fchownat",
@ -130,8 +132,11 @@
"ftruncate",
"ftruncate64",
"futex",
"futex_requeue",
"futex_time64",
"futex_wait",
"futex_waitv",
"futex_wake",
"futimesat",
"getcpu",
"getcwd",
@ -206,6 +211,7 @@
"lstat",
"lstat64",
"madvise",
"map_shadow_stack",
"membarrier",
"memfd_create",
"memfd_secret",
@ -783,7 +789,8 @@
"names": [
"get_mempolicy",
"mbind",
"set_mempolicy"
"set_mempolicy",
"set_mempolicy_home_node"
],
"action": "SCMP_ACT_ALLOW",
"includes": {

7
profiles/seccomp/default_linux.go
View file

@ -56,6 +56,7 @@ func DefaultProfile() *Seccomp {
"alarm",
"bind",
"brk",
"cachestat", // kernel v6.5, libseccomp v2.5.5
"capget",
"capset",
"chdir",
@ -101,6 +102,7 @@ func DefaultProfile() *Seccomp {
"fchdir",
"fchmod",
"fchmodat",
"fchmodat2", // kernel v6.6, libseccomp v2.5.5
"fchown",
"fchown32",
"fchownat",
@ -122,8 +124,11 @@ func DefaultProfile() *Seccomp {
"ftruncate",
"ftruncate64",
"futex",
"futex_requeue", // kernel v6.7, libseccomp v2.5.5
"futex_time64",
"futex_wait", // kernel v6.7, libseccomp v2.5.5
"futex_waitv",
"futex_wake", // kernel v6.7, libseccomp v2.5.5
"futimesat",
"getcpu",
"getcwd",
@ -198,6 +203,7 @@ func DefaultProfile() *Seccomp {
"lstat",
"lstat64",
"madvise",
"map_shadow_stack", // kernel v6.6, libseccomp v2.5.5
"membarrier",
"memfd_create",
"memfd_secret",
@ -771,6 +777,7 @@ func DefaultProfile() *Seccomp {
"get_mempolicy",
"mbind",
"set_mempolicy",
"set_mempolicy_home_node", // kernel v5.17, libseccomp v2.5.4
},
Action: specs.ActAllow,
},