From 6aa8288cfbf2043be5d255361c45c508a29f8f85 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pawe=C5=82=20Gronowski?= Date: Mon, 26 May 2025 15:43:17 +0200 Subject: [PATCH 1/2] profiles/seccomp: kernel v6.12 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit reference: seccomp/libseccomp@f01e675 (libseccomp v2.6.0) containerd/containerd@6180d62 - v6.8: * listmount (torvalds/linux@b4c2bea) * lsm_get_self_attr, lsm_set_self_attrs (torvalds/linux@a04a119) * lsm_list_modules (torvalds/linux@ad4aff9) * statmount (torvalds/linux@46eae99) - v6.9: * mseal (torvalds/linux@8be7258) - v6.11: * uretprobe (torvalds/linux@190fec7) - v6.12: * riscv_hwprobe (torvalds/linux@3db80c9) Signed-off-by: Paweł Gronowski --- profiles/seccomp/default.json | 9 +++++++++ profiles/seccomp/default_linux.go | 9 +++++++++ 2 files changed, 18 insertions(+) diff --git a/profiles/seccomp/default.json b/profiles/seccomp/default.json index c4d91109c3..19b1574fc1 100644 --- a/profiles/seccomp/default.json +++ b/profiles/seccomp/default.json @@ -199,12 +199,16 @@ "link", "linkat", "listen", + "listmount", "listxattr", "llistxattr", "_llseek", "lremovexattr", "lseek", "lsetxattr", + "lsm_get_self_attr", + "lsm_list_modules", + "lsm_set_self_attrs", "lstat", "lstat64", "madvise", @@ -232,6 +236,7 @@ "mq_timedsend_time64", "mq_unlink", "mremap", + "mseal", "msgctl", "msgget", "msgrcv", @@ -281,10 +286,12 @@ "recvmsg", "remap_file_pages", "removexattr", + "removexattrat", "rename", "renameat", "renameat2", "restart_syscall", + "riscv_hwprobe", "rmdir", "rseq", "rt_sigaction", @@ -367,6 +374,7 @@ "stat64", "statfs", "statfs64", + "statmount", "statx", "symlink", "symlinkat", @@ -398,6 +406,7 @@ "uname", "unlink", "unlinkat", + "uretprobe", "utime", "utimensat", "utimensat_time64", diff --git a/profiles/seccomp/default_linux.go b/profiles/seccomp/default_linux.go index 4b7fac05da..c8e69eeab4 100644 --- a/profiles/seccomp/default_linux.go +++ b/profiles/seccomp/default_linux.go @@ -191,12 +191,16 @@ func DefaultProfile() *Seccomp { "link", "linkat", "listen", + "listmount", // kernel v6.8, libseccomp v2.6.0 "listxattr", "llistxattr", "_llseek", "lremovexattr", "lseek", "lsetxattr", + "lsm_get_self_attr", // kernel v6.8, libseccomp v2.6.0 + "lsm_list_modules", // kernel v6.8, libseccomp v2.6.0 + "lsm_set_self_attrs", // kernel v6.8, libseccomp v2.6.0 "lstat", "lstat64", "madvise", @@ -224,6 +228,7 @@ func DefaultProfile() *Seccomp { "mq_timedsend_time64", "mq_unlink", "mremap", + "mseal", // kernel v6.9, libseccomp v2.6.0 "msgctl", "msgget", "msgrcv", @@ -273,10 +278,12 @@ func DefaultProfile() *Seccomp { "recvmsg", "remap_file_pages", "removexattr", + "removexattrat", // kernel v6.13, libseccomp v2.6.0 "rename", "renameat", "renameat2", "restart_syscall", + "riscv_hwprobe", // kernel v6.12, libseccomp v2.6.0 "rmdir", "rseq", "rt_sigaction", @@ -359,6 +366,7 @@ func DefaultProfile() *Seccomp { "stat64", "statfs", "statfs64", + "statmount", // kernel v6.8, libseccomp v2.6.0 "statx", "symlink", "symlinkat", @@ -390,6 +398,7 @@ func DefaultProfile() *Seccomp { "uname", "unlink", "unlinkat", + "uretprobe", // kernel v6.11, libseccomp v2.6.0 "utime", "utimensat", "utimensat_time64", From 0ec3278d48993f98395ebc1d59b04a4206603284 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pawe=C5=82=20Gronowski?= Date: Mon, 26 May 2025 15:44:30 +0200 Subject: [PATCH 2/2] profiles/seccomp: kernel v6.13 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit reference: seccomp/libseccomp@42b5968 (libseccomp v2.6.0) containerd/containerd@1a4c3210 - v6.13: * getxattrat, listxattrat, removexattrat, setxattrat (torvalds/linux@6140be9) Signed-off-by: Paweł Gronowski --- profiles/seccomp/default.json | 3 +++ profiles/seccomp/default_linux.go | 3 +++ 2 files changed, 6 insertions(+) diff --git a/profiles/seccomp/default.json b/profiles/seccomp/default.json index 19b1574fc1..3866d48769 100644 --- a/profiles/seccomp/default.json +++ b/profiles/seccomp/default.json @@ -174,6 +174,7 @@ "getuid", "getuid32", "getxattr", + "getxattrat", "inotify_add_watch", "inotify_init", "inotify_init1", @@ -201,6 +202,7 @@ "listen", "listmount", "listxattr", + "listxattrat", "llistxattr", "_llseek", "lremovexattr", @@ -357,6 +359,7 @@ "setuid", "setuid32", "setxattr", + "setxattrat", "shmat", "shmctl", "shmdt", diff --git a/profiles/seccomp/default_linux.go b/profiles/seccomp/default_linux.go index c8e69eeab4..f45eab5855 100644 --- a/profiles/seccomp/default_linux.go +++ b/profiles/seccomp/default_linux.go @@ -166,6 +166,7 @@ func DefaultProfile() *Seccomp { "getuid", "getuid32", "getxattr", + "getxattrat", // kernel v6.13, libseccomp v2.6.0 "inotify_add_watch", "inotify_init", "inotify_init1", @@ -193,6 +194,7 @@ func DefaultProfile() *Seccomp { "listen", "listmount", // kernel v6.8, libseccomp v2.6.0 "listxattr", + "listxattrat", // kernel v6.13, libseccomp v2.6.0 "llistxattr", "_llseek", "lremovexattr", @@ -349,6 +351,7 @@ func DefaultProfile() *Seccomp { "setuid", "setuid32", "setxattr", + "setxattrat", // kernel v6.13, libseccomp v2.6.0 "shmat", "shmctl", "shmdt",