mirror/runc
1
0
Fork 0
mirror of https://github.com/opencontainers/runc.git synced 2026-07-11 06:03:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

libct/seccomp/patchbpf: support SPEC_ALLOW

Browse Source 
Commit 58ea21daef added support for seccomp flags such as
SPEC_ALLOW, but it does not work as expected, because since commit
7a8d7162f9 we do not use libseccomp-golang's Load(), but
handle flags separately in patchbfp.

This fixes setting SPEC_ALLOW flag.

Add a comment to not forget to amend filterFlags when adding new flags.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
This commit is contained in:
Kir Kolyshkin
2022-08-29 15:35:35 -07:00
parent 4a51b04703
commit c7dc8b1fed
2 changed files with 13 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libcontainer/seccomp/seccomp_linux.go
+1
View File
@@ -105,6 +105,7 @@ func InitSeccomp(config *configs.Seccomp) (int, error) {
if err := filter.SetSSB(true); err != nil {
return -1, fmt.Errorf("error adding SSB flag to seccomp filter: %w", err)
}
// NOTE when adding more flags, make sure to also modify filterFlags in patchbpf.
default:
return -1, fmt.Errorf("seccomp flags %q not yet supported by runc", flag)
}