Alban Crequy 58ea21daef seccomp: add support for flags ...

List of seccomp flags defined in runtime-spec:
* SECCOMP_FILTER_FLAG_TSYNC
* SECCOMP_FILTER_FLAG_LOG
* SECCOMP_FILTER_FLAG_SPEC_ALLOW

Note that runc does not apply SECCOMP_FILTER_FLAG_TSYNC. It does not
make sense to apply the seccomp filter on only one thread; other threads
will be terminated after exec anyway.

See similar commit in crun:
https://github.com/containers/crun/commit/fefabffa2816ea343068ed036a86944393db189a

Note that SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV (introduced by
https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git/commit/?id=c2aa2dfef243
in Linux 5.19-rc1) is not added yet because Linux 5.19 is not released
yet.

Signed-off-by: Alban Crequy <albancrequy@microsoft.com>

2022-07-28 16:25:26 +02:00

..

patchbpf

seccomp: patchbpf: minor cleanups

2022-05-23 16:36:07 +10:00

config.go

libct/seccomp: add riscv64

2022-05-11 17:23:45 -07:00

seccomp_linux.go

seccomp: add support for flags

2022-07-28 16:25:26 +02:00

seccomp_unsupported.go

Add runc features command

2021-11-30 16:40:39 +09:00