diff options
| author | gVisor bot <gvisor-bot@google.com> | 2020-02-03 19:42:22 +0000 |
|---|---|---|
| committer | gVisor bot <gvisor-bot@google.com> | 2020-02-03 19:42:22 +0000 |
| commit | 5d2dfb42039d5e52f7e0f24cea18a7715ffff293 (patch) | |
| tree | 616add05c014b14be5d00c5f658d4b50665c6d67 | |
| parent | 3eb302470365233c163b04b19be0ca13a2eefdba (diff) | |
| parent | 4d1a648c7c5db8a51416bff647260a1be3b5c12e (diff) | |
Merge release-20200127.0-52-g4d1a648 (automated)
| -rw-r--r-- | runsc/boot/filter/config.go | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/runsc/boot/filter/config.go b/runsc/boot/filter/config.go index 4fb9adca6..f8d351c7b 100644 --- a/runsc/boot/filter/config.go +++ b/runsc/boot/filter/config.go @@ -174,6 +174,18 @@ var allowedSyscalls = seccomp.SyscallRules{ syscall.SYS_LSEEK: {}, syscall.SYS_MADVISE: {}, syscall.SYS_MINCORE: {}, + // Used by the Go runtime as a temporarily workaround for a Linux + // 5.2-5.4 bug. + // + // See src/runtime/os_linux_x86.go. + // + // TODO(b/148688965): Remove once this is gone from Go. + syscall.SYS_MLOCK: []seccomp.Rule{ + { + seccomp.AllowAny{}, + seccomp.AllowValue(4096), + }, + }, syscall.SYS_MMAP: []seccomp.Rule{ { seccomp.AllowAny{}, |