diff options
| author | gVisor bot <gvisor-bot@google.com> | 2021-02-04 23:10:08 +0000 |
|---|---|---|
| committer | gVisor bot <gvisor-bot@google.com> | 2021-02-04 23:10:08 +0000 |
| commit | 3f20bbdf41cfbd99f0c937fe8412a0e69717f62e (patch) | |
| tree | 7dd06d77fd2247000337abd9055aaa33c34c2abd /runsc | |
| parent | fe0bbeb1c6ab124eec773fe1b79e0488e6d2c452 (diff) | |
| parent | 41510d2746756818269b0bf8f3961f026a0c247c (diff) | |
Merge release-20210125.0-84-g41510d274 (automated)
Diffstat (limited to 'runsc')
| -rw-r--r-- | runsc/boot/filter/config.go | 9 | ||||
| -rw-r--r-- | runsc/fsgofer/filter/config.go | 9 |
2 files changed, 18 insertions, 0 deletions
diff --git a/runsc/boot/filter/config.go b/runsc/boot/filter/config.go index eacd73531..2a8c916d5 100644 --- a/runsc/boot/filter/config.go +++ b/runsc/boot/filter/config.go @@ -100,6 +100,15 @@ var allowedSyscalls = seccomp.SyscallRules{ seccomp.MatchAny{}, }, }, + // getcpu is used by some versions of the Go runtime and by the hostcpu + // package on arm64. + unix.SYS_GETCPU: []seccomp.Rule{ + { + seccomp.MatchAny{}, + seccomp.EqualTo(0), + seccomp.EqualTo(0), + }, + }, syscall.SYS_GETPID: {}, unix.SYS_GETRANDOM: {}, syscall.SYS_GETSOCKOPT: []seccomp.Rule{ diff --git a/runsc/fsgofer/filter/config.go b/runsc/fsgofer/filter/config.go index 39b8a0b1e..f92e2f80e 100644 --- a/runsc/fsgofer/filter/config.go +++ b/runsc/fsgofer/filter/config.go @@ -107,6 +107,15 @@ var allowedSyscalls = seccomp.SyscallRules{ seccomp.MatchAny{}, }, }, + // getcpu is used by some versions of the Go runtime and by the hostcpu + // package on arm64. + unix.SYS_GETCPU: []seccomp.Rule{ + { + seccomp.MatchAny{}, + seccomp.EqualTo(0), + seccomp.EqualTo(0), + }, + }, syscall.SYS_GETDENTS64: {}, syscall.SYS_GETPID: {}, unix.SYS_GETRANDOM: {}, |