From df57a080b68bf3096041b1c95ffbb0504b2cf167 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Tue, 6 Feb 2024 14:12:31 +0100 Subject: [PATCH] seccomp: add futex_requeue syscall (kernel v6.7, libseccomp v2.5.5) Add this syscall to match the profile in containerd containerd: https://github.com/containerd/containerd/commit/a6e52c74fa043a63d7dae4ac6998215f6c1bb6ac libseccomp: https://github.com/seccomp/libseccomp/commit/53267af3fb56eed93a50b8ef92f41825c97a7813 kernel: https://github.com/torvalds/linux/commit/0f4b5f972216782a4acb1ae00dcb55173847c2ff futex: Add sys_futex_requeue() Finish off the 'simple' futex2 syscall group by adding sys_futex_requeue(). Unlike sys_futex_{wait,wake}() its arguments are too numerous to fit into a regular syscall. As such, use struct futex_waitv to pass the 'source' and 'destination' futexes to the syscall. This syscall implements what was previously known as FUTEX_CMP_REQUEUE and uses {val, uaddr, flags} for source and {uaddr, flags} for destination. This design explicitly allows requeueing between different types of futex by having a different flags word per uaddr. Signed-off-by: Sebastiaan van Stijn --- profiles/seccomp/default.json | 1 + profiles/seccomp/default_linux.go | 1 + 2 files changed, 2 insertions(+) diff --git a/profiles/seccomp/default.json b/profiles/seccomp/default.json index 033fccf57f..ed1b014605 100644 --- a/profiles/seccomp/default.json +++ b/profiles/seccomp/default.json @@ -132,6 +132,7 @@ "ftruncate", "ftruncate64", "futex", + "futex_requeue", "futex_time64", "futex_waitv", "futimesat", diff --git a/profiles/seccomp/default_linux.go b/profiles/seccomp/default_linux.go index da9dcde480..06e733846a 100644 --- a/profiles/seccomp/default_linux.go +++ b/profiles/seccomp/default_linux.go @@ -124,6 +124,7 @@ func DefaultProfile() *Seccomp { "ftruncate", "ftruncate64", "futex", + "futex_requeue", // kernel v6.7, libseccomp v2.5.5 "futex_time64", "futex_waitv", "futimesat",