update seccomp.json
Merge the following changes from the upstream Moby seccomp profile:
* commit ("Whitelist statx syscall for libseccomp-2.3.3
onward")
* commit ("Whitelist syscalls linked to CAP_SYS_NICE in
default seccomp profile")
* commit ("Move the syslog syscall to be gated by
CAP_SYS_ADMIN or CAP_SYSLOG")
"stat64",
"statfs",
"statfs64",
+ "statx",
"symlink",
"symlinkat",
"sync",
"sync_file_range",
"syncfs",
"sysinfo",
- "syslog",
"tee",
"tgkill",
"time",
"setdomainname",
"sethostname",
"setns",
+ "syslog",
"umount",
"umount2",
"unshare"
]
},
"excludes": {}
+ },
+ {
+ "names": [
+ "get_mempolicy",
+ "mbind",
+ "set_mempolicy"
+ ],
+ "action": "SCMP_ACT_ALLOW",
+ "args": [],
+ "comment": "",
+ "includes": {
+ "caps": [
+ "CAP_SYS_NICE"
+ ]
+ },
+ "excludes": {}
+ },
+ {
+ "names": [
+ "syslog"
+ ],
+ "action": "SCMP_ACT_ALLOW",
+ "args": [],
+ "comment": "",
+ "includes": {
+ "caps": [
+ "CAP_SYSLOG"
+ ]
+ },
+ "excludes": {}
}
]
}
