seccomp: add get_mempolicy, mbind, set_mempolicy, with CAP_SYS_NICE
This aligns the profile with docker's profile, which added this in
@@ -652,6 +652,16 @@ func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp {
Action: specs.ActAllow,
Args: []specs.LinuxSeccompArg{},
})
+ case "CAP_SYS_NICE":
+ s.Syscalls = append(s.Syscalls, specs.LinuxSyscall{
+ Names: []string{
+ "get_mempolicy",
+ "mbind",
+ "set_mempolicy",
+ },
+ Action: specs.ActAllow,
+ Args: []specs.LinuxSeccompArg{},
+ })
case "CAP_SYSLOG":
s.Syscalls = append(s.Syscalls, specs.LinuxSyscall{
Names: []string{"syslog"},
