From 5862285facc350859d875a5a37d94dc39d214187 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Mon, 24 Aug 2020 12:36:53 +0200 Subject: [PATCH] seccomp: allow sync_file_range2 on supported architectures. On a ppc64le host, running postgres (tried with 9.4 to 9.6) gives the following warning when trying to flush data to disks (which happens very frequently): WARNING: could not flush dirty data: Operation not permitted. A quick dig in postgres source code indicate it uses sync_file_range(2) to flush data; which on ppe64le and arm64 is translated to sync_file_range2(2) for alignements reasons. The profile did not allow sync_file_range2(2), making postgres sad because it can not flush its buffers. arm_sync_file_range(2) is an ancient alias to sync_file_range2(2), the syscall was renamed in Linux 2.6.22 when the same syscall was added for PowerPC. Signed-off-by: Sebastiaan van Stijn --- contrib/seccomp/seccomp_default.go | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/contrib/seccomp/seccomp_default.go b/contrib/seccomp/seccomp_default.go index f675833ae..0dfdcd4c9 100644 --- a/contrib/seccomp/seccomp_default.go +++ b/contrib/seccomp/seccomp_default.go @@ -455,11 +455,20 @@ func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp { // include by arch switch runtime.GOARCH { + case "ppc64le": + s.Syscalls = append(s.Syscalls, specs.LinuxSyscall{ + Names: []string{ + "sync_file_range2", + }, + Action: specs.ActAllow, + Args: []specs.LinuxSeccompArg{}, + }) case "arm", "arm64": s.Syscalls = append(s.Syscalls, specs.LinuxSyscall{ Names: []string{ "arm_fadvise64_64", "arm_sync_file_range", + "sync_file_range2", "breakpoint", "cacheflush", "set_tls",