glibc calls clone3, which has a very seccomp-unfriendly interface. Thankfully, it falls back to not using clone3 if clone3 is found to return ENOSYS. Therefore, for a runsc binary compiled with cgo (as with this pull request), we can avoid allowing clone3 through if we can get the seccomp rules to return ENOSYS for clone3.
Right now all we have is "allowed" vs "disallowed" syscalls. We need to support adding new RuleSets for seccomp filters such that some syscall numbers can have the action of returning ENOSYS as error code.
glibccallsclone3, which has a very seccomp-unfriendly interface. Thankfully, it falls back to not usingclone3ifclone3is found to returnENOSYS. Therefore, for arunscbinary compiled withcgo(as with this pull request), we can avoid allowingclone3through if we can get the seccomp rules to returnENOSYSforclone3.Right now all we have is "allowed" vs "disallowed" syscalls. We need to support adding new
RuleSets for seccomp filters such that some syscall numbers can have the action of returningENOSYSas error code.