Kir Kolyshkin ac04154f0b seccomp: set SPEC_ALLOW by default ...

If no seccomps flags are set in OCI runtime spec (not even the empty
set), set SPEC_ALLOW as the default (if it's supported).

Otherwise, use the flags as they are set (that includes no flags for
empty seccomp.Flags array).

This mimics the crun behavior, and makes runc seccomp performance on par
with crun.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

2022-11-29 17:24:32 -08:00

..

example.go

runc: do not set inheritable capabilities

2022-05-12 08:14:50 +10:00

spec_linux_test.go

libct/seccomp/config: add missing KillThread, KillProcess

2022-05-04 16:22:09 +02:00

spec_linux.go

seccomp: set SPEC_ALLOW by default

2022-11-29 17:24:32 -08:00