diff --git a/profiles/seccomp/default.json b/profiles/seccomp/default.json index 5717c00cde..c0f140524e 100755 --- a/profiles/seccomp/default.json +++ b/profiles/seccomp/default.json @@ -746,6 +746,22 @@ ] }, "excludes": {} + }, + { + "names": [ + "get_mempolicy", + "mbind", + "set_mempolicy" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": { + "caps": [ + "CAP_SYS_NICE" + ] + }, + "excludes": {} } ] } \ No newline at end of file diff --git a/profiles/seccomp/seccomp_default.go b/profiles/seccomp/seccomp_default.go index be29aa4f70..25360a1277 100644 --- a/profiles/seccomp/seccomp_default.go +++ b/profiles/seccomp/seccomp_default.go @@ -630,6 +630,18 @@ func DefaultProfile() *types.Seccomp { Caps: []string{"CAP_SYS_TTY_CONFIG"}, }, }, + { + Names: []string{ + "get_mempolicy", + "mbind", + "set_mempolicy", + }, + Action: types.ActAllow, + Args: []*types.Arg{}, + Includes: types.Filter{ + Caps: []string{"CAP_SYS_NICE"}, + }, + }, } return &types.Seccomp{