Akihiro Suda 55923daa9f seccomp: support "clone3" (return ENOSYS unless SYS_ADMIN is granted) ...

clone3 is explicitly requested to give ENOSYS instead of the default EPERM, when CAP_SYS_ADMIN is unset.
See moby/moby PR 42681 (thanks to berrange).

Without this commit, rawhide image does not work:
```console
$ sudo ctr run --rm --net-host --seccomp registry.fedoraproject.org/fedora:rawhide foo /usr/bin/curl google.com
curl: (6) getaddrinfo() thread failed to start
```

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

2021-09-15 14:44:45 +09:00

..

seccomp_default_unsupported.go

Run go fmt with Go 1.17

2021-08-22 09:31:50 +09:00

seccomp_default.go

seccomp: support "clone3" (return ENOSYS unless SYS_ADMIN is granted)

2021-09-15 14:44:45 +09:00

seccomp.go

Add --seccomp flag to ctr

2019-08-29 13:02:21 -04:00