seccomp policy should allow fanotify_init without CAP_SYS_ADMIN #2411
Description
common/pkg/seccomp/seccomp.json
Lines 694 to 708 in f01ad5b
Prior to Linux 5.13 (and 5.10.220), calling fanotify_init()
required the CAP_SYS_ADMIN capability. Since Linux 5.13 (and
5.10.220), users may call fanotify_init() without the
CAP_SYS_ADMIN capability to create and initialize an fanotify
group with limited functionality.
The policy needs to be changed to allow this use case.
You can find ruby code to test the issue in moby/moby#49756. It's the equivalent issue to update the policy json for Moby.