diff --git a/vmm/src/seccomp_filters.rs b/vmm/src/seccomp_filters.rs
index 5eb994642..52907bc9b 100644
--- a/vmm/src/seccomp_filters.rs
+++ b/vmm/src/seccomp_filters.rs
@@ -276,6 +276,10 @@ pub fn vmm_thread_filter() -> Result<SeccompFilter, Error> {
             allow_syscall(libc::SYS_statx),
             allow_syscall(libc::SYS_tgkill),
             allow_syscall(libc::SYS_tkill),
+            allow_syscall_if(
+                libc::SYS_umask,
+                or![and![Cond::new(0, ArgLen::DWORD, Eq, 0o077)?]],
+            ),
             #[cfg(target_arch = "x86_64")]
             allow_syscall(libc::SYS_unlink),
             allow_syscall(libc::SYS_wait4),