[systemd-devel] How to disable seccomp in systemd-nspawn?

[Steve Dodd]

On Fri, 26 Jun 2020 at 16:53, Lennart Poettering <lennart at poettering.net>
wrote:

> > We implement a system call allow list, i.e. everything that isn't
> > > explicitly allowed is denied. You can use --system-call-filter=openat2
> > > to allow a specific syscall on top of our defaults, i.e. extend the
> > > allow list, or remove entries from it.
>
[..]

> You might need a newer libseccomp so that the syscall is actually
> known by it. openat2 is a very recent syscall addition, and you need
> to update libseccomp in lockstep if you want it to grok it.
>

I've just been bitten by this - last time I looked into a similar problem,
it seemed the calling code was confused by getting EPERM instead of ENOSYS.
Could we distinguish between these two cases and generate the right error
code? It would save a lot of aggro when working with containers..

S.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/systemd-devel/attachments/20200815/0759a792/attachment.htm>