From 2dbbd10fd644e9e3fbf20c71d7531756b1c1a9e4 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Fri, 13 Nov 2020 13:33:23 +0100 Subject: [PATCH 1/2] seccomp: add pidfd_open and pidfd_send_signal Signed-off-by: Sebastiaan van Stijn --- contrib/seccomp/seccomp_default.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/contrib/seccomp/seccomp_default.go b/contrib/seccomp/seccomp_default.go index f1337e6db388..78fa1e401f83 100644 --- a/contrib/seccomp/seccomp_default.go +++ b/contrib/seccomp/seccomp_default.go @@ -232,6 +232,8 @@ func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp { "openat", "openat2", "pause", + "pidfd_open", + "pidfd_send_signal", "pipe", "pipe2", "poll", From 0a1104bcf3aa543e44c9ead5941f08fff3bdcf27 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Fri, 13 Nov 2020 13:34:49 +0100 Subject: [PATCH 2/2] seccomp: add pidfd_getfd syscall (gated by CAP_SYS_PTRACE) Signed-off-by: Sebastiaan van Stijn --- contrib/seccomp/seccomp_default.go | 1 + 1 file changed, 1 insertion(+) diff --git a/contrib/seccomp/seccomp_default.go b/contrib/seccomp/seccomp_default.go index 78fa1e401f83..dcf6a75e960c 100644 --- a/contrib/seccomp/seccomp_default.go +++ b/contrib/seccomp/seccomp_default.go @@ -573,6 +573,7 @@ func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp { s.Syscalls = append(s.Syscalls, specs.LinuxSyscall{ Names: []string{ "kcmp", + "pidfd_getfd", "process_vm_readv", "process_vm_writev", "ptrace",