Skip to content

quotactl(2) is not whitelisted when granting CAP_SYS_ADMIN using the default seccomp profile #34444

@pmoust

Description

@pmoust

quotactl syscall is not allowed even when granting CAP_SYS_ADMIN using the default seccomp profile.

Steps to reproduce the issue:

  1. Run a container with xfstools with CAP_SYS_ADMIN and CAP_SYS_PTRACE
  2. In the container strace xfs_quota trying to alter quotas in a project
  3. repeat the above with SecurityOpt "seccomp:unconfined"

Describe the results you received:
Error calling quotactl initially whereas with "seccomp:unconfined" the command succeeds

Describe the results you expected:
Be allowed to call quotactl since CAP_SYS_ADMIN is granted.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions