diff options
| author | gVisor bot <gvisor-bot@google.com> | 2020-02-04 21:46:50 +0000 |
|---|---|---|
| committer | gVisor bot <gvisor-bot@google.com> | 2020-02-04 21:46:50 +0000 |
| commit | c6739ff2459aacf18caeead7c521a072ddce146b (patch) | |
| tree | 84efd300e0afc19c007e3041babe4f07acd2cad2 /runsc | |
| parent | 6dd6869490b13613ff0eb278ea9c7745d4792580 (diff) | |
| parent | 6d8bf405bc5e887247534172713bf7d2f5252734 (diff) | |
Merge release-20200127.0-64-g6d8bf40 (automated)
Diffstat (limited to 'runsc')
| -rw-r--r-- | runsc/fsgofer/filter/config.go | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/runsc/fsgofer/filter/config.go b/runsc/fsgofer/filter/config.go index a1792330f..1dce36965 100644 --- a/runsc/fsgofer/filter/config.go +++ b/runsc/fsgofer/filter/config.go @@ -128,6 +128,18 @@ var allowedSyscalls = seccomp.SyscallRules{ syscall.SYS_MADVISE: {}, unix.SYS_MEMFD_CREATE: {}, /// Used by flipcall.PacketWindowAllocator.Init(). syscall.SYS_MKDIRAT: {}, + // Used by the Go runtime as a temporarily workaround for a Linux + // 5.2-5.4 bug. + // + // See src/runtime/os_linux_x86.go. + // + // TODO(b/148688965): Remove once this is gone from Go. + syscall.SYS_MLOCK: []seccomp.Rule{ + { + seccomp.AllowAny{}, + seccomp.AllowValue(4096), + }, + }, syscall.SYS_MMAP: []seccomp.Rule{ { seccomp.AllowAny{}, |