diff --git a/profiles/seccomp/default.json b/profiles/seccomp/default.json index d71499f1bc..921b2bd3fe 100644 --- a/profiles/seccomp/default.json +++ b/profiles/seccomp/default.json @@ -790,6 +790,28 @@ "CAP_SYSLOG" ] } + }, + { + "names": [ + "bpf" + ], + "action": "SCMP_ACT_ALLOW", + "includes": { + "caps": [ + "CAP_BPF" + ] + } + }, + { + "names": [ + "perf_event_open" + ], + "action": "SCMP_ACT_ALLOW", + "includes": { + "caps": [ + "CAP_PERFMON" + ] + } } ] } \ No newline at end of file diff --git a/profiles/seccomp/default_linux.go b/profiles/seccomp/default_linux.go index 45d53ab7af..775ab275d6 100644 --- a/profiles/seccomp/default_linux.go +++ b/profiles/seccomp/default_linux.go @@ -777,6 +777,28 @@ func DefaultProfile() *Seccomp { Caps: []string{"CAP_SYSLOG"}, }, }, + { + LinuxSyscall: specs.LinuxSyscall{ + Names: []string{ + "bpf", + }, + Action: specs.ActAllow, + }, + Includes: &Filter{ + Caps: []string{"CAP_BPF"}, + }, + }, + { + LinuxSyscall: specs.LinuxSyscall{ + Names: []string{ + "perf_event_open", + }, + Action: specs.ActAllow, + }, + Includes: &Filter{ + Caps: []string{"CAP_PERFMON"}, + }, + }, } errnoRet := uint(unix.EPERM)