diff --git a/runsc/boot/filter/extra_filters_race.go b/runsc/boot/filter/extra_filters_race.go index 7a1f98a54..9db5d0c96 100644 --- a/runsc/boot/filter/extra_filters_race.go +++ b/runsc/boot/filter/extra_filters_race.go @@ -26,16 +26,17 @@ import ( func instrumentationFilters() seccomp.SyscallRules { Report("TSAN is enabled: syscall filters less restrictive!") return archInstrumentationFilters(seccomp.SyscallRules{ - unix.SYS_BRK: {}, - unix.SYS_CLOCK_NANOSLEEP: {}, - unix.SYS_CLONE: {}, - unix.SYS_CLONE3: {}, - unix.SYS_FUTEX: {}, - unix.SYS_MMAP: {}, - unix.SYS_MUNLOCK: {}, - unix.SYS_NANOSLEEP: {}, - unix.SYS_OPENAT: {}, - unix.SYS_RSEQ: {}, - unix.SYS_SET_ROBUST_LIST: {}, + unix.SYS_BRK: {}, + unix.SYS_CLOCK_NANOSLEEP: {}, + unix.SYS_CLONE: {}, + unix.SYS_CLONE3: {}, + unix.SYS_FUTEX: {}, + unix.SYS_MMAP: {}, + unix.SYS_MUNLOCK: {}, + unix.SYS_NANOSLEEP: {}, + unix.SYS_OPENAT: {}, + unix.SYS_RSEQ: {}, + unix.SYS_SET_ROBUST_LIST: {}, + unix.SYS_SCHED_GETAFFINITY: {}, }) } diff --git a/runsc/fsgofer/filter/extra_filters_race.go b/runsc/fsgofer/filter/extra_filters_race.go index 1e26b46b8..45e7be028 100644 --- a/runsc/fsgofer/filter/extra_filters_race.go +++ b/runsc/fsgofer/filter/extra_filters_race.go @@ -27,17 +27,18 @@ import ( func instrumentationFilters() seccomp.SyscallRules { log.Warningf("*** SECCOMP WARNING: TSAN is enabled: syscall filters less restrictive!") return archInstrumentationFilters(seccomp.SyscallRules{ - unix.SYS_BRK: {}, - unix.SYS_CLOCK_NANOSLEEP: {}, - unix.SYS_CLONE: {}, - unix.SYS_CLONE3: {}, - unix.SYS_FUTEX: {}, - unix.SYS_MADVISE: {}, - unix.SYS_MMAP: {}, - unix.SYS_MUNLOCK: {}, - unix.SYS_NANOSLEEP: {}, - unix.SYS_OPENAT: {}, - unix.SYS_RSEQ: {}, - unix.SYS_SET_ROBUST_LIST: {}, + unix.SYS_BRK: {}, + unix.SYS_CLOCK_NANOSLEEP: {}, + unix.SYS_CLONE: {}, + unix.SYS_CLONE3: {}, + unix.SYS_FUTEX: {}, + unix.SYS_MADVISE: {}, + unix.SYS_MMAP: {}, + unix.SYS_MUNLOCK: {}, + unix.SYS_NANOSLEEP: {}, + unix.SYS_OPENAT: {}, + unix.SYS_RSEQ: {}, + unix.SYS_SET_ROBUST_LIST: {}, + unix.SYS_SCHED_GETAFFINITY: {}, }) }