diff --git a/contrib/seccomp/seccomp_default.go b/contrib/seccomp/seccomp_default.go index 2adb1c937..ab159bf82 100644 --- a/contrib/seccomp/seccomp_default.go +++ b/contrib/seccomp/seccomp_default.go @@ -55,6 +55,7 @@ func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp { "accept", "accept4", "access", + "adjtimex", "alarm", "bind", "brk", @@ -191,6 +192,7 @@ func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp { "lstat", "lstat64", "madvise", + "membarrier", "memfd_create", "mincore", "mkdir", @@ -235,11 +237,13 @@ func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp { "prctl", "pread64", "preadv", + "preadv2", "prlimit64", "pselect6", "pselect6_time64", "pwrite64", "pwritev", + "pwritev2", "read", "readahead", "readlink", @@ -408,6 +412,28 @@ func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp { }, }, }, + { + Names: []string{"personality"}, + Action: specs.ActAllow, + Args: []specs.LinuxSeccompArg{ + { + Index: 0, + Value: 0x20000, + Op: specs.OpEqualTo, + }, + }, + }, + { + Names: []string{"personality"}, + Action: specs.ActAllow, + Args: []specs.LinuxSeccompArg{ + { + Index: 0, + Value: 0x20008, + Op: specs.OpEqualTo, + }, + }, + }, { Names: []string{"personality"}, Action: specs.ActAllow, @@ -429,11 +455,20 @@ func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp { // include by arch switch runtime.GOARCH { + case "ppc64le": + s.Syscalls = append(s.Syscalls, specs.LinuxSyscall{ + Names: []string{ + "sync_file_range2", + }, + Action: specs.ActAllow, + Args: []specs.LinuxSeccompArg{}, + }) case "arm", "arm64": s.Syscalls = append(s.Syscalls, specs.LinuxSyscall{ Names: []string{ "arm_fadvise64_64", "arm_sync_file_range", + "sync_file_range2", "breakpoint", "cacheflush", "set_tls", @@ -490,6 +525,7 @@ func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp { "mount", "name_to_handle_at", "perf_event_open", + "quotactl", "setdomainname", "sethostname", "setns", @@ -553,7 +589,7 @@ func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp { Names: []string{ "settimeofday", "stime", - "adjtimex", + "clock_settime", }, Action: specs.ActAllow, Args: []specs.LinuxSeccompArg{},