diff --git a/pkg/seccomp/victim/seccomp_test_victim.go b/pkg/seccomp/victim/seccomp_test_victim.go
index 8d6e18e18..229c5cc69 100644
--- a/pkg/seccomp/victim/seccomp_test_victim.go
+++ b/pkg/seccomp/victim/seccomp_test_victim.go
@@ -68,6 +68,7 @@ func main() {
 		unix.SYS_NANOSLEEP:       seccomp.MatchAll{},
 		unix.SYS_OPENAT:          seccomp.MatchAll{},
 		unix.SYS_PPOLL:           seccomp.MatchAll{},
+		unix.SYS_PRCTL:           seccomp.MatchAll{},
 		unix.SYS_PREAD64:         seccomp.MatchAll{},
 		unix.SYS_PSELECT6:        seccomp.MatchAll{},
 		unix.SYS_PWRITE64:        seccomp.MatchAll{},
diff --git a/runsc/boot/filter/config/config_main.go b/runsc/boot/filter/config/config_main.go
index e7c611c23..d8592c433 100644
--- a/runsc/boot/filter/config/config_main.go
+++ b/runsc/boot/filter/config/config_main.go
@@ -210,13 +210,20 @@ var allowedSyscalls = seccomp.MakeSyscallRules(map[uintptr]seccomp.SyscallRule{
 	unix.SYS_MUNMAP:    seccomp.MatchAll{},
 	unix.SYS_NANOSLEEP: seccomp.MatchAll{},
 	unix.SYS_PPOLL:     seccomp.MatchAll{},
-	unix.SYS_PREAD64:   seccomp.MatchAll{},
-	unix.SYS_PREADV:    seccomp.MatchAll{},
-	unix.SYS_PREADV2:   seccomp.MatchAll{},
-	unix.SYS_PWRITE64:  seccomp.MatchAll{},
-	unix.SYS_PWRITEV:   seccomp.MatchAll{},
-	unix.SYS_PWRITEV2:  seccomp.MatchAll{},
-	unix.SYS_READ:      seccomp.MatchAll{},
+	unix.SYS_PRCTL: seccomp.PerArg{
+		seccomp.EqualTo(unix.PR_SET_VMA),
+		seccomp.EqualTo(unix.PR_SET_VMA_ANON_NAME),
+		seccomp.AnyValue{},
+		seccomp.AnyValue{},
+		seccomp.AnyValue{},
+	},
+	unix.SYS_PREAD64:  seccomp.MatchAll{},
+	unix.SYS_PREADV:   seccomp.MatchAll{},
+	unix.SYS_PREADV2:  seccomp.MatchAll{},
+	unix.SYS_PWRITE64: seccomp.MatchAll{},
+	unix.SYS_PWRITEV:  seccomp.MatchAll{},
+	unix.SYS_PWRITEV2: seccomp.MatchAll{},
+	unix.SYS_READ:     seccomp.MatchAll{},
 	unix.SYS_RECVMSG: seccomp.Or{
 		seccomp.PerArg{
 			seccomp.AnyValue{},
diff --git a/runsc/fsgofer/filter/config.go b/runsc/fsgofer/filter/config.go
index 70e613088..0663ff321 100644
--- a/runsc/fsgofer/filter/config.go
+++ b/runsc/fsgofer/filter/config.go
@@ -135,9 +135,16 @@ var allowedSyscalls = seccomp.MakeSyscallRules(map[uintptr]seccomp.SyscallRule{
 	unix.SYS_NANOSLEEP: seccomp.MatchAll{},
 	unix.SYS_OPENAT:    seccomp.MatchAll{},
 	unix.SYS_PPOLL:     seccomp.MatchAll{},
-	unix.SYS_PREAD64:   seccomp.MatchAll{},
-	unix.SYS_PWRITE64:  seccomp.MatchAll{},
-	unix.SYS_READ:      seccomp.MatchAll{},
+	unix.SYS_PRCTL: seccomp.PerArg{
+		seccomp.EqualTo(unix.PR_SET_VMA),
+		seccomp.EqualTo(unix.PR_SET_VMA_ANON_NAME),
+		seccomp.AnyValue{},
+		seccomp.AnyValue{},
+		seccomp.AnyValue{},
+	},
+	unix.SYS_PREAD64:  seccomp.MatchAll{},
+	unix.SYS_PWRITE64: seccomp.MatchAll{},
+	unix.SYS_READ:     seccomp.MatchAll{},
 	unix.SYS_RECVMSG: seccomp.Or{
 		seccomp.PerArg{
 			seccomp.AnyValue{},