From 8b57c2e7402f16c784a7d14ea3f488c5f4d1ad6b Mon Sep 17 00:00:00 2001 From: Andrei Vagin Date: Thu, 13 Jul 2023 14:39:31 -0700 Subject: [PATCH] runsc/seccomp: allow sched_getaffinity if race is on Reported-by: syzbot+a9d200b7b966fb93070d@syzkaller.appspotmail.com PiperOrigin-RevId: 547926332 --- runsc/boot/filter/extra_filters_race.go | 23 ++++++++++---------- runsc/fsgofer/filter/extra_filters_race.go | 25 +++++++++++----------- 2 files changed, 25 insertions(+), 23 deletions(-) diff --git a/runsc/boot/filter/extra_filters_race.go b/runsc/boot/filter/extra_filters_race.go index 7a1f98a54..9db5d0c96 100644 --- a/runsc/boot/filter/extra_filters_race.go +++ b/runsc/boot/filter/extra_filters_race.go @@ -26,16 +26,17 @@ import ( func instrumentationFilters() seccomp.SyscallRules { Report("TSAN is enabled: syscall filters less restrictive!") return archInstrumentationFilters(seccomp.SyscallRules{ - unix.SYS_BRK: {}, - unix.SYS_CLOCK_NANOSLEEP: {}, - unix.SYS_CLONE: {}, - unix.SYS_CLONE3: {}, - unix.SYS_FUTEX: {}, - unix.SYS_MMAP: {}, - unix.SYS_MUNLOCK: {}, - unix.SYS_NANOSLEEP: {}, - unix.SYS_OPENAT: {}, - unix.SYS_RSEQ: {}, - unix.SYS_SET_ROBUST_LIST: {}, + unix.SYS_BRK: {}, + unix.SYS_CLOCK_NANOSLEEP: {}, + unix.SYS_CLONE: {}, + unix.SYS_CLONE3: {}, + unix.SYS_FUTEX: {}, + unix.SYS_MMAP: {}, + unix.SYS_MUNLOCK: {}, + unix.SYS_NANOSLEEP: {}, + unix.SYS_OPENAT: {}, + unix.SYS_RSEQ: {}, + unix.SYS_SET_ROBUST_LIST: {}, + unix.SYS_SCHED_GETAFFINITY: {}, }) } diff --git a/runsc/fsgofer/filter/extra_filters_race.go b/runsc/fsgofer/filter/extra_filters_race.go index 1e26b46b8..45e7be028 100644 --- a/runsc/fsgofer/filter/extra_filters_race.go +++ b/runsc/fsgofer/filter/extra_filters_race.go @@ -27,17 +27,18 @@ import ( func instrumentationFilters() seccomp.SyscallRules { log.Warningf("*** SECCOMP WARNING: TSAN is enabled: syscall filters less restrictive!") return archInstrumentationFilters(seccomp.SyscallRules{ - unix.SYS_BRK: {}, - unix.SYS_CLOCK_NANOSLEEP: {}, - unix.SYS_CLONE: {}, - unix.SYS_CLONE3: {}, - unix.SYS_FUTEX: {}, - unix.SYS_MADVISE: {}, - unix.SYS_MMAP: {}, - unix.SYS_MUNLOCK: {}, - unix.SYS_NANOSLEEP: {}, - unix.SYS_OPENAT: {}, - unix.SYS_RSEQ: {}, - unix.SYS_SET_ROBUST_LIST: {}, + unix.SYS_BRK: {}, + unix.SYS_CLOCK_NANOSLEEP: {}, + unix.SYS_CLONE: {}, + unix.SYS_CLONE3: {}, + unix.SYS_FUTEX: {}, + unix.SYS_MADVISE: {}, + unix.SYS_MMAP: {}, + unix.SYS_MUNLOCK: {}, + unix.SYS_NANOSLEEP: {}, + unix.SYS_OPENAT: {}, + unix.SYS_RSEQ: {}, + unix.SYS_SET_ROBUST_LIST: {}, + unix.SYS_SCHED_GETAFFINITY: {}, }) }