From c66b56683beb63b34f98d418f3f3e13b0aa2097e Mon Sep 17 00:00:00 2001 From: Manabu Sugimoto Date: Wed, 3 Nov 2021 21:38:15 +0900 Subject: [PATCH] agent: Ignore unknown seccomp system calls If Kata agent cannot resolve the system calls given by seccomp profiles, the agent ignores the system calls and continues to run without an error. Fixes: #2957 Signed-off-by: Manabu Sugimoto --- src/agent/rustjail/src/seccomp.rs | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/src/agent/rustjail/src/seccomp.rs b/src/agent/rustjail/src/seccomp.rs index 58e85c482..75d938f25 100644 --- a/src/agent/rustjail/src/seccomp.rs +++ b/src/agent/rustjail/src/seccomp.rs @@ -68,7 +68,14 @@ pub fn init_seccomp(scmp: &LinuxSeccomp) -> Result<()> { } for name in &syscall.names { - let syscall_num = get_syscall_from_name(name, None)?; + let syscall_num = match get_syscall_from_name(name, None) { + Ok(num) => num, + Err(_) => { + // If we cannot resolve the given system call, we assume it is not supported + // by the kernel. Hence, we skip it without generating an error. + continue; + } + }; if syscall.args.is_empty() { filter.add_rule(action, syscall_num, None)?;