WIP: ship minimal seccomp profile

Signed-off-by: Peter Hunt <pehunt@redhat.com>
cri-o · Feb 2, 2022 · 8fe261a · 8fe261a
1 parent f545f4d
commit 8fe261a
Showing 1 changed file with 16 additions and 0 deletions.
diff --git a/internal/config/seccomp/seccomp.go b/internal/config/seccomp/seccomp.go
@@ -57,6 +57,22 @@ func (c *Config) LoadProfile(profilePath string) error {
 		c.profile = seccomp.DefaultProfile()
 		logrus.Info("No seccomp profile specified, using the internal default")
 
+		c.profile.DefaultAction = seccomp.ActAllow
+		c.profile.DefaultErrnoRet = nil
+		c.profile.Syscalls = []*seccomp.Syscall{
+			&seccomp.Syscall{
+				Names: []string{
+					"unshare",
+				},
+				Action: seccomp.ActErrno,
+				Excludes: seccomp.Filter{
+					Caps: []string{
+						"CAP_SYS_ADMIN",
+					},
+				},
+			},
+		}
+
 		if logrus.IsLevelEnabled(logrus.TraceLevel) {
 			profileString, err := json.MarshalToString(c.profile)
 			if err != nil {