chrony-seccomp.patch

   1 commit bbbd80bf03223f181d4abf5c8e5fe6136ab6129a
   2 Author: Miroslav Lichvar <mlichvar@redhat.com>
   3 Date:   Mon Aug 9 11:48:21 2021 +0200
   4
   5     sys_linux: allow clone3 and pread64 in seccomp filter
   6
   7     These seem to be needed with the latest glibc.
   8
   9 diff --git a/sys_linux.c b/sys_linux.c
  10 index 50c08431..2b53f722 100644
  11 --- a/sys_linux.c
  12 +++ b/sys_linux.c
  13 @@ -503,6 +503,9 @@ SYS_Linux_EnableSystemCallFilter(int level, SYS_ProcessContext context)
  14
  15      /* Process */
  16      SCMP_SYS(clone),
  17 +#ifdef __NR_clone3
  18 +    SCMP_SYS(clone3),
  19 +#endif
  20      SCMP_SYS(exit),
  21      SCMP_SYS(exit_group),
  22      SCMP_SYS(getpid),
  23 @@ -595,6 +598,7 @@ SYS_Linux_EnableSystemCallFilter(int level, SYS_ProcessContext context)
  24  #ifdef __NR_ppoll_time64
  25      SCMP_SYS(ppoll_time64),
  26  #endif
  27 +    SCMP_SYS(pread64),
  28      SCMP_SYS(pselect6),
  29  #ifdef __NR_pselect6_time64
  30      SCMP_SYS(pselect6_time64),