Incorrect generated seccomp profile for ASP.NET Core app

Expected Behavior

Running docker-slim build on an ASP.NET Core application should produce a seccomp profile that can be successfully used when running the container.

Actual Behavior

Attempting to use the generated seccomp profile results in a failure to start the container. This is because the syscalls contained in the seccomp profile is missing fstatfs.

Steps to Reproduce the Problem

1. git clone https://github.com/dotnet/dotnet-docker.git

2. cd dotnet-docker/samples/aspnetapp

3. docker-slim build --dockerfile Dockerfile.debian-x64-slim --expose 80 --copy-meta-artifacts artifacts --tag-fat app --tag app.min .

4. docker run --rm -it -p 8000:80 --security-opt seccomp=artifacts/app-seccomp.json app.min

   Failure Result:

   docker: Error response from daemon: OCI runtime create failed: container_linux.go:370: starting container process caused: close exec fds: ensure /proc/self/fd is on procfs: operation not permitted: unknown.
   

5. Open the artifacts/app-seccomp.json file in a text editor.

6. Add fstatfs to the list of syscall names and save the file.

7. docker run --rm -it -p 8000:80 --security-opt seccomp=artifacts/app-seccomp.json app.min

   Successful Result:

   warn: Microsoft.AspNetCore.DataProtection.Repositories.FileSystemXmlRepository[60]
         Storing keys in a directory '/.aspnet/DataProtection-Keys' that may not be persisted outside of the container. Protected data will be unavailable when container is destroyed.
   warn: Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager[35]
         No XML encryptor configured. Key {c31322cc-fec6-4a7a-9dbf-3798a9e5db7c} may be persisted to storage in unencrypted form.
   info: Microsoft.Hosting.Lifetime[0]
         Now listening on: http://[::]:80
   info: Microsoft.Hosting.Lifetime[0]
         Application started. Press Ctrl+C to shut down.
   info: Microsoft.Hosting.Lifetime[0]
         Hosting environment: Production
   info: Microsoft.Hosting.Lifetime[0]
         Content root path: /app
   

Specifications

• Version: docker-slim version linux|Transformer|1.34.0|a5cb54043b3ab3cf747165aad745f19db680434e|2021-01-29_10:00:49PM
• Platform: Ubuntu 20.04

Start by running the listed docker-slim build and docker run commands in dotnet-docker/samples/aspnetapp, then inspect artifacts/app-seccomp.json. Done means the generated profile includes fstatfs and the app.min container starts successfully with that profile.