From 1746a195e9dc8b974733cd295e82aedc56525079 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Mon, 24 Aug 2020 12:09:27 +0200 Subject: [PATCH] seccomp: allow adjtimex get time operation Enabled adjtimex in the default profile without requiring CAP_SYS_TIME privilege. The kernel will check CAP_SYS_TIME and won't allow setting the time. Fixes: Getting the system time with ntptime returns an error in an unprivileged container To verify, inside a CentOS 7 container: yum install -y ntp ntptime # ntp_gettime() returns code 0 (OK) ntpdate -v time.nist.gov # ntpdate[84]: Can't adjust the time of day: Operation not permitted Signed-off-by: Sebastiaan van Stijn --- contrib/seccomp/seccomp_default.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/contrib/seccomp/seccomp_default.go b/contrib/seccomp/seccomp_default.go index a20b3670c..3305b6be1 100644 --- a/contrib/seccomp/seccomp_default.go +++ b/contrib/seccomp/seccomp_default.go @@ -55,6 +55,7 @@ func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp { "accept", "accept4", "access", + "adjtimex", "alarm", "bind", "brk", @@ -555,7 +556,6 @@ func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp { Names: []string{ "settimeofday", "stime", - "adjtimex", }, Action: specs.ActAllow, Args: []specs.LinuxSeccompArg{},