From c90a71e32977183b41e321be4ac34068a8cb4f2b Mon Sep 17 00:00:00 2001 From: Bo Chen Date: Fri, 14 Aug 2020 16:16:13 -0700 Subject: [PATCH] virtio-devices: seccomp: Add 'brk' syscall to the rng thread From the experiments of running integration tests on my local machine, auditd occationally reported the 'brk' syscall is needed for the 'virtio-rng' worker thread. Signed-off-by: Bo Chen --- virtio-devices/src/seccomp_filters.rs | 1 + 1 file changed, 1 insertion(+) diff --git a/virtio-devices/src/seccomp_filters.rs b/virtio-devices/src/seccomp_filters.rs index b8b558241..062cfd2b0 100644 --- a/virtio-devices/src/seccomp_filters.rs +++ b/virtio-devices/src/seccomp_filters.rs @@ -159,6 +159,7 @@ fn virtio_pmem_thread_rules() -> Result, Error> { fn virtio_rng_thread_rules() -> Result, Error> { Ok(vec![ + allow_syscall(libc::SYS_brk), allow_syscall(libc::SYS_close), allow_syscall(libc::SYS_dup), allow_syscall(libc::SYS_epoll_create1),