pkg/seccomp/conversion.go | 1 1 + 0 - 0 !
pkg/seccomp/default_linux.go | 184 181 + 3 - 0 !
pkg/seccomp/filter.go | 2 1 + 1 - 0 !
pkg/seccomp/seccomp.json | 219 219 + 0 - 0 !
pkg/seccomp/seccomp_linux.go | 1 1 + 0 - 0 !
pkg/seccomp/types.go | 3 2 + 1 - 0 !
6 files changed, 405 insertions(+), 5 deletions(-)

 [patch 1/2] seccomp: add support for defaulterrnoret

Add support to specify the default errno return value.

The OCI runtime specs already have support for it, and both crun (>=
0.19) and runc (>= 1.0-rc95) have support for it.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

pkg/seccomp/default_linux.go | 1 1 + 0 - 0 !
pkg/seccomp/seccomp.json | 1 1 + 0 - 0 !
2 files changed, 2 insertions(+)

 [patch] add setns to default seccomp.json

In order to run containers within containers via podman
and do a podman exec, we need to allow setns syscalls.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>

pkg/seccomp/default_linux.go | 2 1 + 1 - 0 !
pkg/seccomp/seccomp.json | 2 1 + 1 - 0 !
2 files changed, 2 insertions(+), 2 deletions(-)

 [patch] seccomp: allow clone3

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

pkg/seccomp/default_linux.go | 3 0 + 3 - 0 !
pkg/seccomp/seccomp.json | 3 0 + 3 - 0 !
2 files changed, 6 deletions(-)

 [patch] seccomp: let io_uring_* fail with enosys

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

pkg/seccomp/default_linux.go | 6 3 + 3 - 0 !
pkg/seccomp/seccomp.json | 6 3 + 3 - 0 !
2 files changed, 6 insertions(+), 6 deletions(-)

 [patch] seccomp: allow pkey_*

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

pkg/seccomp/default_linux.go | 2 1 + 1 - 0 !
pkg/seccomp/seccomp.json | 2 1 + 1 - 0 !
2 files changed, 2 insertions(+), 2 deletions(-)

 [patch] seccomp: allow rseq

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

pkg/seccomp/default_linux.go | 1 0 + 1 - 0 !
pkg/seccomp/seccomp.json | 1 0 + 1 - 0 !
2 files changed, 2 deletions(-)

 [patch] seccomp: let membarrier fail with enosys

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

pkg/seccomp/default_linux.go | 3 3 + 0 - 0 !
pkg/seccomp/seccomp.json | 3 3 + 0 - 0 !
2 files changed, 6 insertions(+)

 [patch] seccomp: always allow get_mempolicy, set_mempolicy, mbind

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

pkg/config/config.go | 11 8 + 3 - 0 !
1 file changed, 8 insertions(+), 3 deletions(-)

---