Merge pull request #50097 from vvoland/seccomp-lsm

vvoland · web-flow · commit 8330a083d5f6 · 2025-05-28T12:05:57.000Z
seccomp: Require CAP_SYS_ADMIN for lsm_* syscalls
diff --git a/profiles/seccomp/default.json b/profiles/seccomp/default.json
@@ -208,9 +208,6 @@
 				"lremovexattr",
 				"lseek",
 				"lsetxattr",
-				"lsm_get_self_attr",
-				"lsm_list_modules",
-				"lsm_set_self_attrs",
 				"lstat",
 				"lstat64",
 				"madvise",
@@ -614,6 +611,9 @@
 				"fsopen",
 				"fspick",
 				"lookup_dcookie",
+				"lsm_get_self_attr",
+				"lsm_list_modules",
+				"lsm_set_self_attr",
 				"mount",
 				"mount_setattr",
 				"move_mount",
diff --git a/profiles/seccomp/default_linux.go b/profiles/seccomp/default_linux.go
@@ -200,9 +200,6 @@ func DefaultProfile() *Seccomp {
 					"lremovexattr",
 					"lseek",
 					"lsetxattr",
-					"lsm_get_self_attr",  // kernel v6.8, libseccomp v2.6.0
-					"lsm_list_modules",   // kernel v6.8, libseccomp v2.6.0
-					"lsm_set_self_attrs", // kernel v6.8, libseccomp v2.6.0
 					"lstat",
 					"lstat64",
 					"madvise",
@@ -605,6 +602,9 @@ func DefaultProfile() *Seccomp {
 					"fsopen",
 					"fspick",
 					"lookup_dcookie",
+					"lsm_get_self_attr", // kernel v6.8, libseccomp v2.6.0
+					"lsm_list_modules",  // kernel v6.8, libseccomp v2.6.0
+					"lsm_set_self_attr", // kernel v6.8, libseccomp v2.6.0
 					"mount",
 					"mount_setattr",
 					"move_mount",
