update controller seccomp profile

Author: Mike Ludwig

helm/openwhisk/templates/seccomp-cm.yaml

@@ -478,9 +478,11 @@ data:
       "syscalls": [
         {
           "names": [
-            "setgid",
-            "setuid",
+            "accept",
+            "accept4",
             "access",
+            "adjtimex",
+            "alarm",
             "bind",
             "brk",
             "capget",
@@ -489,11 +491,16 @@ data:
             "chmod",
             "chown",
             "chown32",
+            "clock_adjtime",
+            "clock_adjtime64",
             "clock_getres",
             "clock_getres_time64",
             "clock_gettime",
             "clock_gettime64",
+            "clock_nanosleep",
+            "clock_nanosleep_time64",
             "close",
+            "close_range",
             "connect",
             "copy_file_range",
             "creat",
@@ -591,6 +598,8 @@ data:
             "ioprio_set",
             "ipc",
             "kill",
+            "lchown",
+            "lchown32",
             "lgetxattr",
             "link",
             "linkat",
@@ -623,6 +632,8 @@ data:
             "msgrcv",
             "msgsnd",
             "msync",
+            "munlock",
+            "munlockall",
             "munmap",
             "nanosleep",
             "newfstatat",
@@ -643,6 +654,11 @@ data:
             "preadv",
             "preadv2",
             "prlimit64",
+            "pselect6",
+            "pselect6_time64",
+            "pwrite64",
+            "pwritev",
+            "pwritev2",
             "read",
             "readahead",
             "readlink",
@@ -696,6 +712,12 @@ data:
             "sendmmsg",
             "sendmsg",
             "sendto",
+            "setfsgid",
+            "setfsgid32",
+            "setfsuid",
+            "setfsuid32",
+            "setgid",
+            "setgid32",
             "setgroups",
             "setgroups32",
             "setitimer",
@@ -705,17 +727,24 @@ data:
             "setregid32",
             "setresgid",
             "setresgid32",
+            "setresuid",
+            "setresuid32",
+            "setreuid",
+            "setreuid32",
             "setrlimit",
             "set_robust_list",
             "setsid",
             "setsockopt",
             "set_thread_area",
             "set_tid_address",
+            "setuid",
+            "setuid32",
             "setxattr",
             "shmat",
             "shmctl",
             "shmdt",
             "shmget",
+            "shutdown",
             "sigaltstack",
             "signalfd",
             "signalfd4",
@@ -739,6 +768,18 @@ data:
             "tee",
             "tgkill",
             "time",
+            "timer_create",
+            "timer_delete",
+            "timer_getoverrun",
+            "timer_gettime",
+            "timer_gettime64",
+            "timer_settime",
+            "timer_settime64",
+            "timerfd_create",
+            "timerfd_gettime",
+            "timerfd_gettime64",
+            "timerfd_settime",
+            "timerfd_settime64",
             "times",
             "tkill",
             "truncate",
@@ -838,6 +879,45 @@ data:
               "s390x"
             ]
           }
+        },
+        {
+          "names": [
+            "clone"
+          ],
+          "action": "SCMP_ACT_ALLOW",
+          "args": [
+            {
+              "index": 1,
+              "value": 2114060288,
+              "op": "SCMP_CMP_MASKED_EQ"
+            }
+          ],
+          "comment": "s390 parameter ordering for clone is different",
+          "includes": {
+            "arches": [
+              "s390",
+              "s390x"
+            ]
+          },
+          "excludes": {
+            "caps": [
+              "CAP_SYS_ADMIN"
+            ]
+          }
+        },
+        {
+          "names": [
+            "syslog"
+          ],
+          "action": "SCMP_ACT_ALLOW",
+          "args": [],
+          "comment": "",
+          "includes": {
+            "caps": [
+              "CAP_SYSLOG"
+            ]
+          },
+          "excludes": {}
         }
       ]
     }