From 4d1a648c7c5db8a51416bff647260a1be3b5c12e Mon Sep 17 00:00:00 2001 From: Michael Pratt Date: Mon, 3 Feb 2020 11:39:01 -0800 Subject: Allow mlock in system call filters Go 1.14 has a workaround for a Linux 5.2-5.4 bug which requires mlock'ing the g stack to prevent register corruption. We need to allow this syscall until it is removed from Go. PiperOrigin-RevId: 292967478 --- runsc/boot/filter/config.go | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'runsc/boot') diff --git a/runsc/boot/filter/config.go b/runsc/boot/filter/config.go index 4fb9adca6..f8d351c7b 100644 --- a/runsc/boot/filter/config.go +++ b/runsc/boot/filter/config.go @@ -174,6 +174,18 @@ var allowedSyscalls = seccomp.SyscallRules{ syscall.SYS_LSEEK: {}, syscall.SYS_MADVISE: {}, syscall.SYS_MINCORE: {}, + // Used by the Go runtime as a temporarily workaround for a Linux + // 5.2-5.4 bug. + // + // See src/runtime/os_linux_x86.go. + // + // TODO(b/148688965): Remove once this is gone from Go. + syscall.SYS_MLOCK: []seccomp.Rule{ + { + seccomp.AllowAny{}, + seccomp.AllowValue(4096), + }, + }, syscall.SYS_MMAP: []seccomp.Rule{ { seccomp.AllowAny{}, -- cgit v1.2.3