github/kata-containers
1
0
Fork 1
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-04-28 19:54:35 +00:00
Code Issues Projects Releases Wiki Activity

virtcontainers: clh: Enable the seccomp feature

Browse Source 
This patch enables the `seccomp` feature from Cloud Hypervisor which
provides fine-grained allowed syscalls for each of its worker
threads. It brings important security benefits, while would increase
memory footprint.

Fixes: #2782

Signed-off-by: Bo Chen <chen.bo@intel.com>
This commit is contained in:
Bo Chen 2021-10-08 15:07:43 -07:00
parent 0300e91cd0
commit 98b7350a1b
1 changed files with 0 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/runtime/virtcontainers/clh.go
View File

@ -947,11 +947,6 @@ func (clh *cloudHypervisor) launchClh() (int, error) {
args = append(args, "-v")
}
// Disable the 'seccomp' option in clh for now.
// In this way, we can separate the periodic failures caused
// by incomplete `seccomp` filters from other failures.
// We will bring it back after completing the `seccomp` filter.
args = append(args, "--seccomp", "false")
clh.Logger().WithField("path", clhPath).Info()
clh.Logger().WithField("args", strings.Join(args, " ")).Info()