diff --git a/runsc/boot/filter/config.go b/runsc/boot/filter/config.go index 66f9d5224..fa1095887 100644 --- a/runsc/boot/filter/config.go +++ b/runsc/boot/filter/config.go @@ -183,18 +183,6 @@ var allowedSyscalls = seccomp.SyscallRules{ }, }, unix.SYS_MINCORE: {}, - // Used by the Go runtime as a temporarily workaround for a Linux - // 5.2-5.4 bug. - // - // See src/runtime/os_linux_x86.go. - // - // TODO(b/148688965): Remove once this is gone from Go. - unix.SYS_MLOCK: []seccomp.Rule{ - { - seccomp.MatchAny{}, - seccomp.EqualTo(4096), - }, - }, unix.SYS_MMAP: []seccomp.Rule{ { seccomp.MatchAny{}, diff --git a/runsc/boot/filter/config_amd64.go b/runsc/boot/filter/config_amd64.go index 8015a0e52..e0786542f 100644 --- a/runsc/boot/filter/config_amd64.go +++ b/runsc/boot/filter/config_amd64.go @@ -19,16 +19,10 @@ package filter import ( "golang.org/x/sys/unix" - "gvisor.dev/gvisor/pkg/abi/linux" "gvisor.dev/gvisor/pkg/seccomp" ) func init() { - allowedSyscalls[unix.SYS_ARCH_PRCTL] = []seccomp.Rule{ - // TODO(b/168828518): No longer used in Go 1.16+. - {seccomp.EqualTo(linux.ARCH_SET_FS)}, - } - allowedSyscalls[unix.SYS_CLONE] = []seccomp.Rule{ // parent_tidptr and child_tidptr are always 0 because neither // CLONE_PARENT_SETTID nor CLONE_CHILD_SETTID are used. diff --git a/runsc/fsgofer/filter/config.go b/runsc/fsgofer/filter/config.go index 246b7ed3c..49ddf5f0c 100644 --- a/runsc/fsgofer/filter/config.go +++ b/runsc/fsgofer/filter/config.go @@ -126,18 +126,6 @@ var allowedSyscalls = seccomp.SyscallRules{ unix.SYS_MEMFD_CREATE: {}, /// Used by flipcall.PacketWindowAllocator.Init(). unix.SYS_MKDIRAT: {}, unix.SYS_MKNODAT: {}, - // Used by the Go runtime as a temporarily workaround for a Linux - // 5.2-5.4 bug. - // - // See src/runtime/os_linux_x86.go. - // - // TODO(b/148688965): Remove once this is gone from Go. - unix.SYS_MLOCK: []seccomp.Rule{ - { - seccomp.MatchAny{}, - seccomp.EqualTo(4096), - }, - }, unix.SYS_MMAP: []seccomp.Rule{ { seccomp.MatchAny{},