diff options
| author | gVisor bot <gvisor-bot@google.com> | 2020-06-01 22:36:11 +0000 |
|---|---|---|
| committer | gVisor bot <gvisor-bot@google.com> | 2020-06-01 22:36:11 +0000 |
| commit | 03a52fd004ab3ccc9144d0e67108a4ca527c564e (patch) | |
| tree | 188f270731de68d80e0f15e132897e31d5489f5d /runsc | |
| parent | a5ff9164eb283d99a2e66428267b01bb0c23ba46 (diff) | |
| parent | 3a987160aa09f814a8459ed3f6192ce741b701a3 (diff) | |
Merge release-20200522.0-55-g3a987160 (automated)
Diffstat (limited to 'runsc')
| -rw-r--r-- | runsc/boot/filter/config.go | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/runsc/boot/filter/config.go b/runsc/boot/filter/config.go index 98cdd90dd..60e33425f 100644 --- a/runsc/boot/filter/config.go +++ b/runsc/boot/filter/config.go @@ -288,6 +288,14 @@ var allowedSyscalls = seccomp.SyscallRules{ syscall.SYS_SIGALTSTACK: {}, unix.SYS_STATX: {}, syscall.SYS_SYNC_FILE_RANGE: {}, + syscall.SYS_TEE: []seccomp.Rule{ + { + seccomp.AllowAny{}, + seccomp.AllowAny{}, + seccomp.AllowValue(1), /* len */ + seccomp.AllowValue(unix.SPLICE_F_NONBLOCK), /* flags */ + }, + }, syscall.SYS_TGKILL: []seccomp.Rule{ { seccomp.AllowValue(uint64(os.Getpid())), |