lablup / lablup/backend.ai-jail
Update seccomp profiles
- Dominant language
- Rust
- Stars
- 8
- Forks
- 2
- PR merge metrics
- No merged PRs in 30d
Description
ref) https://docs.docker.com/engine/release-notes/ (20.10 series)
> * seccomp: Whitelist clock_adjtime. CAP_SYS_TIME is still required for time adjustment moby/moby#40929
> * seccomp: Add openat2 and faccessat2 to default seccomp profile moby/moby#41353
> * seccomp: allow ‘rseq’ syscall in default seccomp profile moby/moby#41158
> * seccomp: allow syscall membarrier moby/moby#40731
> * seccomp: whitelist io-uring related system calls moby/moby#39415
> * Fix seccomp profile for clone syscall moby/moby#39308
Contributor guide
No contributing guide indexed for this repository
Research direction
No source files or tests are named. Compare the existing seccomp profile with the Docker Engine 20.10 release notes and the listed Moby changes, then inspect how the sandbox loads and validates that profile. Done means the requested syscalls are correctly handled without weakening the sandbox, with validation covering the updated profile.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux
- Domain
- operating-systems, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 20/100