From 67bb54919cf082f822e2155b9f0f0cda8bcd7708 Mon Sep 17 00:00:00 2001
From: Andrei Vagin <avagin@google.com>
Date: Wed, 5 Jan 2022 16:18:42 -0800
Subject: [PATCH] Remove unused syscalls from filters

mlock gone in Go 1.16 in https://golang.org/cl/246200.
The Go runtime (on amd64) switches from using arch_prctl(ARCH_SET_FS)
to CLONE_SETTLS to set the TLS.

PiperOrigin-RevId: 419935904
---
 runsc/boot/filter/config.go       | 12 ------------
 runsc/boot/filter/config_amd64.go |  6 ------
 runsc/fsgofer/filter/config.go    | 12 ------------
 3 files changed, 30 deletions(-)

diff --git a/runsc/boot/filter/config.go b/runsc/boot/filter/config.go
index 66f9d5224..fa1095887 100644
--- a/runsc/boot/filter/config.go
+++ b/runsc/boot/filter/config.go
@@ -183,18 +183,6 @@ var allowedSyscalls = seccomp.SyscallRules{
 		},
 	},
 	unix.SYS_MINCORE: {},
-	// Used by the Go runtime as a temporarily workaround for a Linux
-	// 5.2-5.4 bug.
-	//
-	// See src/runtime/os_linux_x86.go.
-	//
-	// TODO(b/148688965): Remove once this is gone from Go.
-	unix.SYS_MLOCK: []seccomp.Rule{
-		{
-			seccomp.MatchAny{},
-			seccomp.EqualTo(4096),
-		},
-	},
 	unix.SYS_MMAP: []seccomp.Rule{
 		{
 			seccomp.MatchAny{},
diff --git a/runsc/boot/filter/config_amd64.go b/runsc/boot/filter/config_amd64.go
index 8015a0e52..e0786542f 100644
--- a/runsc/boot/filter/config_amd64.go
+++ b/runsc/boot/filter/config_amd64.go
@@ -19,16 +19,10 @@ package filter
 
 import (
 	"golang.org/x/sys/unix"
-	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/seccomp"
 )
 
 func init() {
-	allowedSyscalls[unix.SYS_ARCH_PRCTL] = []seccomp.Rule{
-		// TODO(b/168828518): No longer used in Go 1.16+.
-		{seccomp.EqualTo(linux.ARCH_SET_FS)},
-	}
-
 	allowedSyscalls[unix.SYS_CLONE] = []seccomp.Rule{
 		// parent_tidptr and child_tidptr are always 0 because neither
 		// CLONE_PARENT_SETTID nor CLONE_CHILD_SETTID are used.
diff --git a/runsc/fsgofer/filter/config.go b/runsc/fsgofer/filter/config.go
index 246b7ed3c..49ddf5f0c 100644
--- a/runsc/fsgofer/filter/config.go
+++ b/runsc/fsgofer/filter/config.go
@@ -126,18 +126,6 @@ var allowedSyscalls = seccomp.SyscallRules{
 	unix.SYS_MEMFD_CREATE: {}, /// Used by flipcall.PacketWindowAllocator.Init().
 	unix.SYS_MKDIRAT:      {},
 	unix.SYS_MKNODAT:      {},
-	// Used by the Go runtime as a temporarily workaround for a Linux
-	// 5.2-5.4 bug.
-	//
-	// See src/runtime/os_linux_x86.go.
-	//
-	// TODO(b/148688965): Remove once this is gone from Go.
-	unix.SYS_MLOCK: []seccomp.Rule{
-		{
-			seccomp.MatchAny{},
-			seccomp.EqualTo(4096),
-		},
-	},
 	unix.SYS_MMAP: []seccomp.Rule{
 		{
 			seccomp.MatchAny{},