From 19faaba94592bb8087ec68569398236af6654ef3 Mon Sep 17 00:00:00 2001
From: Valentin Rothberg <vrothberg@suse.com>
Date: Thu, 8 Nov 2018 14:10:39 +0100
Subject: [PATCH] update seccomp.json
Merge the following changes from the upstream Moby seccomp profile:
* commit b2a907c8cab6 ("Whitelist statx syscall for libseccomp-2.3.3
onward")
* commit 47dfff68e436 ("Whitelist syscalls linked to CAP_SYS_NICE in
default seccomp profile")
* commit ccd22ffcc8b5 ("Move the syslog syscall to be gated by
CAP_SYS_ADMIN or CAP_SYSLOG")
Signed-off-by: Valentin Rothberg <vrothberg@suse.com>
---
seccomp.json | 33 ++++++++++++++++++++++++++++++++-
1 file changed, 32 insertions(+), 1 deletion(-)
diff --git a/seccomp.json b/seccomp.json
index 19fadb4bbb..fd0681a864 100644
--- a/seccomp.json
+++ b/seccomp.json
@@ -322,13 +322,13 @@
"stat64",
"statfs",
"statfs64",
+ "statx",
"symlink",
"symlinkat",
"sync",
"sync_file_range",
"syncfs",
"sysinfo",
- "syslog",
"tee",
"tgkill",
"time",
@@ -565,6 +565,7 @@
"setdomainname",
"sethostname",
"setns",
+ "syslog",
"umount",
"umount2",
"unshare"
@@ -750,6 +751,36 @@
]
},
"excludes": {}
+ },
+ {
+ "names": [
+ "get_mempolicy",
+ "mbind",
+ "set_mempolicy"
+ ],
+ "action": "SCMP_ACT_ALLOW",
+ "args": [],
+ "comment": "",
+ "includes": {
+ "caps": [
+ "CAP_SYS_NICE"
+ ]
+ },
+ "excludes": {}
+ },
+ {
+ "names": [
+ "syslog"
+ ],
+ "action": "SCMP_ACT_ALLOW",
+ "args": [],
+ "comment": "",
+ "includes": {
+ "caps": [
+ "CAP_SYSLOG"
+ ]
+ },
+ "excludes": {}
}
]
}