Aleksa Sarai 618e149e4a [1.1] seccomp: patchbpf: always include native architecture in stub ...

(This is a backport of ccc500c427da731554a181f2ea407adf99870423.)

It turns out that on ppc64le (at least), Docker doesn't include any
architectures in the list of allowed architectures. libseccomp
interprets this as "just include the default architecture" but patchbpf
would return a no-op ENOSYS stub, which would lead to the exact issues
that commit 7a8d7162f9 ("seccomp: prepend -ENOSYS stub to all
filters") fixed for other architectures.

So, just always include the running architecture in the list. There's
no real downside.

Ref: https://bugzilla.suse.com/show_bug.cgi?id=1192051#c6
Fixes: 7a8d7162f9 ("seccomp: prepend -ENOSYS stub to all filters")
Reported-by: Fabian Vogt <fvogt@suse.com>
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>

2024-09-03 13:17:47 +10:00

..

patchbpf

[1.1] seccomp: patchbpf: always include native architecture in stub

2024-09-03 13:17:47 +10:00

config.go

libct/seccomp: add riscv64

2023-06-28 22:34:45 +03:00

seccomp_linux.go

fix deprecated ActKill

2022-05-20 11:30:16 -07:00

seccomp_unsupported.go

Add runc features command

2021-11-30 16:40:39 +09:00