diff options
| author | gVisor bot <gvisor-bot@google.com> | 2019-12-03 16:37:36 +0000 |
|---|---|---|
| committer | gVisor bot <gvisor-bot@google.com> | 2019-12-03 16:37:36 +0000 |
| commit | 5259f9596e5640dc624c2ed8f41eaff5326e3e1a (patch) | |
| tree | ea92bb18aa0bd43bc97cbea07309d96f82e9f525 /runsc/boot | |
| parent | 71aa826922bd6ffde0db10d12c769600b133970b (diff) | |
| parent | 19b2d997ec702e559bdb5f5e60634a7c5d7d288e (diff) | |
Merge release-20191114.0-49-g19b2d99 (automated)
Diffstat (limited to 'runsc/boot')
| -rw-r--r-- | runsc/boot/filter/config.go | 24 |
1 files changed, 24 insertions, 0 deletions
diff --git a/runsc/boot/filter/config.go b/runsc/boot/filter/config.go index bf690160c..4fb9adca6 100644 --- a/runsc/boot/filter/config.go +++ b/runsc/boot/filter/config.go @@ -313,11 +313,21 @@ func hostInetFilters() seccomp.SyscallRules { { seccomp.AllowAny{}, seccomp.AllowValue(syscall.SOL_IP), + seccomp.AllowValue(syscall.IP_TOS), + }, + { + seccomp.AllowAny{}, + seccomp.AllowValue(syscall.SOL_IP), seccomp.AllowValue(syscall.IP_RECVTOS), }, { seccomp.AllowAny{}, seccomp.AllowValue(syscall.SOL_IPV6), + seccomp.AllowValue(syscall.IPV6_TCLASS), + }, + { + seccomp.AllowAny{}, + seccomp.AllowValue(syscall.SOL_IPV6), seccomp.AllowValue(syscall.IPV6_RECVTCLASS), }, { @@ -426,6 +436,13 @@ func hostInetFilters() seccomp.SyscallRules { { seccomp.AllowAny{}, seccomp.AllowValue(syscall.SOL_IP), + seccomp.AllowValue(syscall.IP_TOS), + seccomp.AllowAny{}, + seccomp.AllowValue(4), + }, + { + seccomp.AllowAny{}, + seccomp.AllowValue(syscall.SOL_IP), seccomp.AllowValue(syscall.IP_RECVTOS), seccomp.AllowAny{}, seccomp.AllowValue(4), @@ -433,6 +450,13 @@ func hostInetFilters() seccomp.SyscallRules { { seccomp.AllowAny{}, seccomp.AllowValue(syscall.SOL_IPV6), + seccomp.AllowValue(syscall.IPV6_TCLASS), + seccomp.AllowAny{}, + seccomp.AllowValue(4), + }, + { + seccomp.AllowAny{}, + seccomp.AllowValue(syscall.SOL_IPV6), seccomp.AllowValue(syscall.IPV6_RECVTCLASS), seccomp.AllowAny{}, seccomp.AllowValue(4), |