netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

runsc: Whitelist lstat, as it is now used in specutils.

Browse Source 
When running multi-container, child containers are added after the filters have
been installed. Thus, lstat must be in the set of allowed syscalls.

PiperOrigin-RevId: 201269550
Change-Id: I03f2e6675a53d462ed12a0f651c10049b76d4c52
This commit is contained in:
Kevin Krakauer
2018-06-19 17:17:41 -07:00
committed by Shentubot
parent 18d8992453
commit 3ebd0e35f4
1 changed files with 32 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
runsc/boot/filter/config.go
+32 -29
View File
@@ -24,35 +24,38 @@ import (
// allowedSyscalls is the set of syscalls executed by the Sentry
// to the host OS.
var allowedSyscalls = seccomp.SyscallRules{
syscall.SYS_ACCEPT: {},
syscall.SYS_ARCH_PRCTL: {},
syscall.SYS_CLOCK_GETTIME: {},
syscall.SYS_CLONE: {},
syscall.SYS_CLOSE: {},
syscall.SYS_DUP: {},
syscall.SYS_DUP2: {},
syscall.SYS_EPOLL_CREATE1: {},
syscall.SYS_EPOLL_CTL: {},
syscall.SYS_EPOLL_PWAIT: {},
syscall.SYS_EPOLL_WAIT: {},
syscall.SYS_EVENTFD2: {},
syscall.SYS_EXIT: {},
syscall.SYS_EXIT_GROUP: {},
syscall.SYS_FALLOCATE: {},
syscall.SYS_FCHMOD: {},
syscall.SYS_FCNTL: {},
syscall.SYS_FSTAT: {},
syscall.SYS_FSYNC: {},
syscall.SYS_FTRUNCATE: {},
syscall.SYS_FUTEX: {},
syscall.SYS_GETDENTS64: {},
syscall.SYS_GETPID: {},
unix.SYS_GETRANDOM: {},
syscall.SYS_GETSOCKOPT: {},
syscall.SYS_GETTID: {},
syscall.SYS_GETTIMEOFDAY: {},
syscall.SYS_LISTEN: {},
syscall.SYS_LSEEK: {},
syscall.SYS_ACCEPT: {},
syscall.SYS_ARCH_PRCTL: {},
syscall.SYS_CLOCK_GETTIME: {},
syscall.SYS_CLONE: {},
syscall.SYS_CLOSE: {},
syscall.SYS_DUP: {},
syscall.SYS_DUP2: {},
syscall.SYS_EPOLL_CREATE1: {},
syscall.SYS_EPOLL_CTL: {},
syscall.SYS_EPOLL_PWAIT: {},
syscall.SYS_EPOLL_WAIT: {},
syscall.SYS_EVENTFD2: {},
syscall.SYS_EXIT: {},
syscall.SYS_EXIT_GROUP: {},
syscall.SYS_FALLOCATE: {},
syscall.SYS_FCHMOD: {},
syscall.SYS_FCNTL: {},
syscall.SYS_FSTAT: {},
syscall.SYS_FSYNC: {},
syscall.SYS_FTRUNCATE: {},
syscall.SYS_FUTEX: {},
syscall.SYS_GETDENTS64: {},
syscall.SYS_GETPID: {},
unix.SYS_GETRANDOM: {},
syscall.SYS_GETSOCKOPT: {},
syscall.SYS_GETTID: {},
syscall.SYS_GETTIMEOFDAY: {},
syscall.SYS_LISTEN: {},
syscall.SYS_LSEEK: {},
// TODO: Remove SYS_LSTAT when executable lookup moves
// into the gofer.
syscall.SYS_LSTAT: {},
syscall.SYS_MADVISE: {},
syscall.SYS_MINCORE: {},
syscall.SYS_MMAP: {},