From 19faaba94592bb8087ec68569398236af6654ef3 Mon Sep 17 00:00:00 2001
From: Valentin Rothberg <vrothberg@suse.com>
Date: Thu, 8 Nov 2018 14:10:39 +0100
Subject: update seccomp.json

Merge the following changes from the upstream Moby seccomp profile:

 * commit b2a907c8cab6 ("Whitelist statx syscall for libseccomp-2.3.3
                         onward")

 * commit 47dfff68e436 ("Whitelist syscalls linked to CAP_SYS_NICE in
                         default seccomp profile")

 * commit ccd22ffcc8b5 ("Move the syslog syscall to be gated by
                         CAP_SYS_ADMIN or CAP_SYSLOG")

Signed-off-by: Valentin Rothberg <vrothberg@suse.com>
---
 seccomp.json | 33 ++++++++++++++++++++++++++++++++-
 1 file changed, 32 insertions(+), 1 deletion(-)

diff --git a/seccomp.json b/seccomp.json
index 19fadb4bb..fd0681a86 100644
--- a/seccomp.json
+++ b/seccomp.json
@@ -322,13 +322,13 @@
 				"stat64",
 				"statfs",
 				"statfs64",
+				"statx",
 				"symlink",
 				"symlinkat",
 				"sync",
 				"sync_file_range",
 				"syncfs",
 				"sysinfo",
-				"syslog",
 				"tee",
 				"tgkill",
 				"time",
@@ -565,6 +565,7 @@
 				"setdomainname",
 				"sethostname",
 				"setns",
+				"syslog",
 				"umount",
 				"umount2",
 				"unshare"
@@ -750,6 +751,36 @@
 				]
 			},
 			"excludes": {}
+		},
+		{
+			"names": [
+				"get_mempolicy",
+				"mbind",
+				"set_mempolicy"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"args": [],
+			"comment": "",
+			"includes": {
+				"caps": [
+					"CAP_SYS_NICE"
+				]
+			},
+			"excludes": {}
+		},
+		{
+			"names": [
+				"syslog"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"args": [],
+			"comment": "",
+			"includes": {
+				"caps": [
+					"CAP_SYSLOG"
+				]
+			},
+			"excludes": {}
 		}
 	]
 }
-- 
cgit v1.2.3-54-g00ecf