Update seccomp.json

podman-update/build/seccomp.json

@@ -1,5 +1,6 @@
 {
 	"defaultAction": "SCMP_ACT_ERRNO",
+	"defaultErrnoRet": 1,
 	"archMap": [
 		{
 			"architecture": "SCMP_ARCH_X86_64",
@@ -47,6 +48,10 @@
 			"subArchitectures": [
 				"SCMP_ARCH_S390"
 			]
+		},
+		{
+			"architecture": "SCMP_ARCH_RISCV64",
+			"subArchitectures": null
 		}
 	],
 	"syscalls": [
@@ -126,6 +131,7 @@
 				"ftruncate64",
 				"futex",
 				"futex_time64",
+				"futex_waitv",
 				"futimesat",
 				"getcpu",
 				"getcwd",
@@ -182,6 +188,9 @@
 				"io_uring_setup",
 				"ipc",
 				"kill",
+				"landlock_add_rule",
+				"landlock_create_ruleset",
+				"landlock_restrict_self",
 				"lchown",
 				"lchown32",
 				"lgetxattr",
@@ -199,6 +208,7 @@
 				"madvise",
 				"membarrier",
 				"memfd_create",
+				"memfd_secret",
 				"mincore",
 				"mkdir",
 				"mkdirat",
@@ -238,6 +248,9 @@
 				"pidfd_send_signal",
 				"pipe",
 				"pipe2",
+				"pkey_alloc",
+				"pkey_free",
+				"pkey_mprotect",
 				"poll",
 				"ppoll",
 				"ppoll_time64",
@@ -246,6 +259,7 @@
 				"preadv",
 				"preadv2",
 				"prlimit64",
+				"process_mrelease",
 				"pselect6",
 				"pselect6_time64",
 				"pwrite64",
@@ -342,7 +356,6 @@
 				"signalfd4",
 				"sigprocmask",
 				"sigreturn",
-        "socket",
 				"socketcall",
 				"socketpair",
 				"splice",
@@ -393,11 +406,7 @@
 				"write",
 				"writev"
 			],
-      "action": "SCMP_ACT_ALLOW",
+			"action": "SCMP_ACT_ALLOW"
-      "args": [],
-      "comment": "",
-      "includes": {},
-      "excludes": {}
 		},
 		{
 			"names": [
@@ -406,12 +415,22 @@
 				"ptrace"
 			],
 			"action": "SCMP_ACT_ALLOW",
-      "args": null,
-      "comment": "",
 			"includes": {
 				"minKernel": "4.8"
+			}
 		},
-      "excludes": {}
+		{
+			"names": [
+				"socket"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"args": [
+				{
+					"index": 0,
+					"value": 40,
+					"op": "SCMP_CMP_NE"
+				}
+			]
 		},
 		{
 			"names": [
@@ -424,10 +443,7 @@
 					"value": 0,
 					"op": "SCMP_CMP_EQ"
 				}
-      ],
+			]
-      "comment": "",
-      "includes": {},
-      "excludes": {}
 		},
 		{
 			"names": [
@@ -440,10 +456,7 @@
 					"value": 8,
 					"op": "SCMP_CMP_EQ"
 				}
-      ],
+			]
-      "comment": "",
-      "includes": {},
-      "excludes": {}
 		},
 		{
 			"names": [
@@ -456,10 +469,7 @@
 					"value": 131072,
 					"op": "SCMP_CMP_EQ"
 				}
-      ],
+			]
-      "comment": "",
-      "includes": {},
-      "excludes": {}
 		},
 		{
 			"names": [
@@ -472,10 +482,7 @@
 					"value": 131080,
 					"op": "SCMP_CMP_EQ"
 				}
-      ],
+			]
-      "comment": "",
-      "includes": {},
-      "excludes": {}
 		},
 		{
 			"names": [
@@ -488,24 +495,19 @@
 					"value": 4294967295,
 					"op": "SCMP_CMP_EQ"
 				}
-      ],
+			]
-      "comment": "",
-      "includes": {},
-      "excludes": {}
 		},
 		{
 			"names": [
-        "sync_file_range2"
+				"sync_file_range2",
+				"swapcontext"
 			],
 			"action": "SCMP_ACT_ALLOW",
-      "args": [],
-      "comment": "",
 			"includes": {
 				"arches": [
 					"ppc64le"
 				]
-      },
+			}
-      "excludes": {}
 		},
 		{
 			"names": [
@@ -517,46 +519,37 @@
 				"set_tls"
 			],
 			"action": "SCMP_ACT_ALLOW",
-      "args": [],
-      "comment": "",
 			"includes": {
 				"arches": [
 					"arm",
 					"arm64"
 				]
-      },
+			}
-      "excludes": {}
 		},
 		{
 			"names": [
 				"arch_prctl"
 			],
 			"action": "SCMP_ACT_ALLOW",
-      "args": [],
-      "comment": "",
 			"includes": {
 				"arches": [
 					"amd64",
 					"x32"
 				]
-      },
+			}
-      "excludes": {}
 		},
 		{
 			"names": [
 				"modify_ldt"
 			],
 			"action": "SCMP_ACT_ALLOW",
-      "args": [],
-      "comment": "",
 			"includes": {
 				"arches": [
 					"amd64",
 					"x32",
 					"x86"
 				]
-      },
+			}
-      "excludes": {}
 		},
 		{
 			"names": [
@@ -565,34 +558,39 @@
 				"s390_runtime_instr"
 			],
 			"action": "SCMP_ACT_ALLOW",
-      "args": [],
-      "comment": "",
 			"includes": {
 				"arches": [
 					"s390",
 					"s390x"
 				]
+			}
 		},
-      "excludes": {}
+		{
+			"names": [
+				"riscv_flush_icache"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"includes": {
+				"arches": [
+					"riscv64"
+				]
+			}
 		},
 		{
 			"names": [
 				"open_by_handle_at"
 			],
 			"action": "SCMP_ACT_ALLOW",
-      "args": [],
-      "comment": "",
 			"includes": {
 				"caps": [
 					"CAP_DAC_READ_SEARCH"
 				]
-      },
+			}
-      "excludes": {}
 		},
 		{
 			"names": [
-        "bpf",
 				"clone",
+				"clone3",
 				"fanotify_init",
 				"fsconfig",
 				"fsmount",
@@ -600,11 +598,13 @@
 				"fspick",
 				"lookup_dcookie",
 				"mount",
+				"mount_setattr",
 				"move_mount",
 				"name_to_handle_at",
 				"open_tree",
 				"perf_event_open",
 				"quotactl",
+				"quotactl_fd",
 				"setdomainname",
 				"sethostname",
 				"setns",
@@ -614,14 +614,11 @@
 				"unshare"
 			],
 			"action": "SCMP_ACT_ALLOW",
-      "args": [],
-      "comment": "",
 			"includes": {
 				"caps": [
 					"CAP_SYS_ADMIN"
 				]
-      },
+			}
-      "excludes": {}
 		},
 		{
 			"names": [
@@ -635,8 +632,6 @@
 					"op": "SCMP_CMP_MASKED_EQ"
 				}
 			],
-      "comment": "",
-      "includes": {},
 			"excludes": {
 				"caps": [
 					"CAP_SYS_ADMIN"
@@ -672,33 +667,39 @@
 				]
 			}
 		},
+		{
+			"names": [
+				"clone3"
+			],
+			"action": "SCMP_ACT_ERRNO",
+			"errnoRet": 38,
+			"excludes": {
+				"caps": [
+					"CAP_SYS_ADMIN"
+				]
+			}
+		},
 		{
 			"names": [
 				"reboot"
 			],
 			"action": "SCMP_ACT_ALLOW",
-      "args": [],
-      "comment": "",
 			"includes": {
 				"caps": [
 					"CAP_SYS_BOOT"
 				]
-      },
+			}
-      "excludes": {}
 		},
 		{
 			"names": [
 				"chroot"
 			],
 			"action": "SCMP_ACT_ALLOW",
-      "args": [],
-      "comment": "",
 			"includes": {
 				"caps": [
 					"CAP_SYS_CHROOT"
 				]
-      },
+			}
-      "excludes": {}
 		},
 		{
 			"names": [
@@ -707,28 +708,22 @@
 				"finit_module"
 			],
 			"action": "SCMP_ACT_ALLOW",
-      "args": [],
-      "comment": "",
 			"includes": {
 				"caps": [
 					"CAP_SYS_MODULE"
 				]
-      },
+			}
-      "excludes": {}
 		},
 		{
 			"names": [
 				"acct"
 			],
 			"action": "SCMP_ACT_ALLOW",
-      "args": [],
-      "comment": "",
 			"includes": {
 				"caps": [
 					"CAP_SYS_PACCT"
 				]
-      },
+			}
-      "excludes": {}
 		},
 		{
 			"names": [
@@ -740,14 +735,11 @@
 				"ptrace"
 			],
 			"action": "SCMP_ACT_ALLOW",
-      "args": [],
-      "comment": "",
 			"includes": {
 				"caps": [
 					"CAP_SYS_PTRACE"
 				]
-      },
+			}
-      "excludes": {}
 		},
 		{
 			"names": [
@@ -755,44 +747,36 @@
 				"ioperm"
 			],
 			"action": "SCMP_ACT_ALLOW",
-      "args": [],
-      "comment": "",
 			"includes": {
 				"caps": [
 					"CAP_SYS_RAWIO"
 				]
-      },
+			}
-      "excludes": {}
 		},
 		{
 			"names": [
 				"settimeofday",
 				"stime",
-        "clock_settime"
+				"clock_settime",
+				"clock_settime64"
 			],
 			"action": "SCMP_ACT_ALLOW",
-      "args": [],
-      "comment": "",
 			"includes": {
 				"caps": [
 					"CAP_SYS_TIME"
 				]
-      },
+			}
-      "excludes": {}
 		},
 		{
 			"names": [
 				"vhangup"
 			],
 			"action": "SCMP_ACT_ALLOW",
-      "args": [],
-      "comment": "",
 			"includes": {
 				"caps": [
 					"CAP_SYS_TTY_CONFIG"
 				]
-      },
+			}
-      "excludes": {}
 		},
 		{
 			"names": [
@@ -801,28 +785,33 @@
 				"set_mempolicy"
 			],
 			"action": "SCMP_ACT_ALLOW",
-      "args": [],
-      "comment": "",
 			"includes": {
 				"caps": [
 					"CAP_SYS_NICE"
 				]
-      },
+			}
-      "excludes": {}
 		},
 		{
 			"names": [
 				"syslog"
 			],
 			"action": "SCMP_ACT_ALLOW",
-      "args": [],
-      "comment": "",
 			"includes": {
 				"caps": [
 					"CAP_SYSLOG"
 				]
+			}
 		},
-      "excludes": {}
+		{
+			"names": [
+				"perf_event_open"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"includes": {
+				"caps": [
+					"CAP_PERFMON"
+				]
+			}
 		}
 	]
 }