diff options
Diffstat (limited to 'profiles')
| -rwxr-xr-x | profiles/seccomp/default.json | 15 | ||||
| -rw-r--r-- | profiles/seccomp/seccomp_default.go | 33 |
2 files changed, 30 insertions, 18 deletions
diff --git a/profiles/seccomp/default.json b/profiles/seccomp/default.json index 51ec3d43bb..40af6ad3b5 100755 --- a/profiles/seccomp/default.json +++ b/profiles/seccomp/default.json @@ -687,6 +687,21 @@ "args": [] }, { + "name": "mlock", + "action": "SCMP_ACT_ALLOW", + "args": [] + }, + { + "name": "mlock2", + "action": "SCMP_ACT_ALLOW", + "args": [] + }, + { + "name": "mlockall", + "action": "SCMP_ACT_ALLOW", + "args": [] + }, + { "name": "mmap", "action": "SCMP_ACT_ALLOW", "args": [] diff --git a/profiles/seccomp/seccomp_default.go b/profiles/seccomp/seccomp_default.go index 87ae358ff5..9e8d47f929 100644 --- a/profiles/seccomp/seccomp_default.go +++ b/profiles/seccomp/seccomp_default.go @@ -722,6 +722,21 @@ func DefaultProfile(rs *specs.Spec) *types.Seccomp { Args: []*types.Arg{}, }, { + Name: "mlock", + Action: types.ActAllow, + Args: []*types.Arg{}, + }, + { + Name: "mlock2", + Action: types.ActAllow, + Args: []*types.Arg{}, + }, + { + Name: "mlockall", + Action: types.ActAllow, + Args: []*types.Arg{}, + }, + { Name: "mmap", Action: types.ActAllow, Args: []*types.Arg{}, @@ -1663,24 +1678,6 @@ func DefaultProfile(rs *specs.Spec) *types.Seccomp { Args: []*types.Arg{}, }, }...) - case "CAP_IPC_LOCK": - syscalls = append(syscalls, []*types.Syscall{ - { - Name: "mlock", - Action: types.ActAllow, - Args: []*types.Arg{}, - }, - { - Name: "mlock2", - Action: types.ActAllow, - Args: []*types.Arg{}, - }, - { - Name: "mlockall", - Action: types.ActAllow, - Args: []*types.Arg{}, - }, - }...) case "CAP_SYS_ADMIN": capSysAdmin = true syscalls = append(syscalls, []*types.Syscall{ |