From 1f03087a84ac1f21aa80e4be1d3d900a3e4c6f4e Mon Sep 17 00:00:00 2001
From: Andrei Vagin <avagin@google.com>
Date: Fri, 18 Feb 2022 14:29:36 -0800
Subject: [PATCH] Remove unused syscalls from filters

mlock gone in Go 1.16 in https://golang.org/cl/246200.
The Go runtime (on amd64) switches from using arch_prctl(ARCH_SET_FS)
to CLONE_SETTLS to set the TLS.

PiperOrigin-RevId: 429648960
---
 runsc/boot/filter/config_amd64.go    | 14 --------------
 runsc/fsgofer/filter/config_amd64.go | 20 --------------------
 2 files changed, 34 deletions(-)

diff --git a/runsc/boot/filter/config_amd64.go b/runsc/boot/filter/config_amd64.go
index e0786542f..c77598349 100644
--- a/runsc/boot/filter/config_amd64.go
+++ b/runsc/boot/filter/config_amd64.go
@@ -40,19 +40,5 @@ func init() {
 			seccomp.EqualTo(0), // child_tidptr
 			seccomp.MatchAny{}, // tls
 		},
-		{
-			// TODO(b/168828518): No longer used in Go 1.16+ (on amd64).
-			seccomp.EqualTo(
-				unix.CLONE_VM |
-					unix.CLONE_FS |
-					unix.CLONE_FILES |
-					unix.CLONE_SIGHAND |
-					unix.CLONE_SYSVSEM |
-					unix.CLONE_THREAD),
-			seccomp.MatchAny{}, // newsp
-			seccomp.EqualTo(0), // parent_tidptr
-			seccomp.EqualTo(0), // child_tidptr
-			seccomp.MatchAny{}, // tls
-		},
 	}
 }
diff --git a/runsc/fsgofer/filter/config_amd64.go b/runsc/fsgofer/filter/config_amd64.go
index 1cb9d312a..e0bb95a4d 100644
--- a/runsc/fsgofer/filter/config_amd64.go
+++ b/runsc/fsgofer/filter/config_amd64.go
@@ -19,16 +19,10 @@ package filter
 
 import (
 	"golang.org/x/sys/unix"
-	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/seccomp"
 )
 
 func init() {
-	allowedSyscalls[unix.SYS_ARCH_PRCTL] = []seccomp.Rule{
-		// TODO(b/168828518): No longer used in Go 1.16+.
-		{seccomp.EqualTo(linux.ARCH_SET_FS)},
-	}
-
 	allowedSyscalls[unix.SYS_CLONE] = []seccomp.Rule{
 		// parent_tidptr and child_tidptr are always 0 because neither
 		// CLONE_PARENT_SETTID nor CLONE_CHILD_SETTID are used.
@@ -46,20 +40,6 @@ func init() {
 			seccomp.EqualTo(0), // child_tidptr
 			seccomp.MatchAny{}, // tls
 		},
-		{
-			// TODO(b/168828518): No longer used in Go 1.16+ (on amd64).
-			seccomp.EqualTo(
-				unix.CLONE_VM |
-					unix.CLONE_FS |
-					unix.CLONE_FILES |
-					unix.CLONE_SIGHAND |
-					unix.CLONE_SYSVSEM |
-					unix.CLONE_THREAD),
-			seccomp.MatchAny{}, // newsp
-			seccomp.EqualTo(0), // parent_tidptr
-			seccomp.EqualTo(0), // child_tidptr
-			seccomp.MatchAny{}, // tls
-		},
 	}
 
 	allowedSyscalls[unix.SYS_NEWFSTATAT] = []seccomp.Rule{}