From 1251982cf7a079c97d4e67cfd69d4e03ab55edc7 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Tue, 6 Feb 2024 13:20:39 +0100 Subject: [PATCH] seccomp: add set_mempolicy_home_node syscall (kernel v5.17, libseccomp v2.5.4) This syscall is gated by CAP_SYS_NICE, matching the profile in containerd. containerd: https://github.com/containerd/containerd/commit/a6e52c74fa043a63d7dae4ac6998215f6c1bb6ac libseccomp: https://github.com/seccomp/libseccomp/commit/d83cb7ac252db91e9ca9c372ea4743e02ba97c50 kernel: https://github.com/torvalds/linux/commit/c6018b4b254971863bd0ad36bb5e7d0fa0f0ddb0 mm/mempolicy: add set_mempolicy_home_node syscall This syscall can be used to set a home node for the MPOL_BIND and MPOL_PREFERRED_MANY memory policy. Users should use this syscall after setting up a memory policy for the specified range as shown below. mbind(p, nr_pages * page_size, MPOL_BIND, new_nodes->maskp, new_nodes->size + 1, 0); sys_set_mempolicy_home_node((unsigned long)p, nr_pages * page_size, home_node, 0); The syscall allows specifying a home node/preferred node from which kernel will fulfill memory allocation requests first. ... Signed-off-by: Sebastiaan van Stijn --- profiles/seccomp/default.json | 3 ++- profiles/seccomp/default_linux.go | 1 + 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/profiles/seccomp/default.json b/profiles/seccomp/default.json index c6d82f668b..0e260c72a6 100644 --- a/profiles/seccomp/default.json +++ b/profiles/seccomp/default.json @@ -780,7 +780,8 @@ "names": [ "get_mempolicy", "mbind", - "set_mempolicy" + "set_mempolicy", + "set_mempolicy_home_node" ], "action": "SCMP_ACT_ALLOW", "includes": { diff --git a/profiles/seccomp/default_linux.go b/profiles/seccomp/default_linux.go index d2f7d5653a..aef6a97dbb 100644 --- a/profiles/seccomp/default_linux.go +++ b/profiles/seccomp/default_linux.go @@ -768,6 +768,7 @@ func DefaultProfile() *Seccomp { "get_mempolicy", "mbind", "set_mempolicy", + "set_mempolicy_home_node", // kernel v5.17, libseccomp v2.5.4 }, Action: specs.ActAllow, },