From a42c131c80fc8c7220687c56cf4384a224572ca0 Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Mon, 25 Oct 2021 07:22:11 -0400 Subject: Update vendor github.com/opencontainers/runtime-tools This will change mount of /dev within container to noexec, making containers slightly more secure. [NO NEW TESTS NEEDED] Signed-off-by: Daniel J Walsh --- .../runtime-tools/generate/seccomp/seccomp_default.go | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'vendor/github.com/opencontainers/runtime-tools/generate/seccomp/seccomp_default.go') diff --git a/vendor/github.com/opencontainers/runtime-tools/generate/seccomp/seccomp_default.go b/vendor/github.com/opencontainers/runtime-tools/generate/seccomp/seccomp_default.go index 5fee5a3b2..8a8dc3970 100644 --- a/vendor/github.com/opencontainers/runtime-tools/generate/seccomp/seccomp_default.go +++ b/vendor/github.com/opencontainers/runtime-tools/generate/seccomp/seccomp_default.go @@ -566,6 +566,20 @@ func DefaultProfile(rs *specs.Spec) *rspec.LinuxSeccomp { }, }...) /* Flags parameter of the clone syscall is the 2nd on s390 */ + syscalls = append(syscalls, []rspec.LinuxSyscall{ + { + Names: []string{"clone"}, + Action: rspec.ActAllow, + Args: []rspec.LinuxSeccompArg{ + { + Index: 1, + Value: 2080505856, + ValueTwo: 0, + Op: rspec.OpMaskedEqual, + }, + }, + }, + }...) } return &rspec.LinuxSeccomp{ -- cgit v1.2.3-54-g00ecf