Allow the dup syscall, it is used on glibc systems when GeoIP lookups…

… are enabled.
fcambus · Oct 23, 2019 · fe0e621 · fe0e621
1 parent ab8c474
commit fe0e621
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/src/seccomp.h b/src/seccomp.h
@@ -25,6 +25,8 @@ static struct sock_filter filter[] = {
 	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
 	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SYS_close, 0, 1),
 	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
+	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SYS_dup, 0, 1),
+	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
 	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SYS_exit_group, 0, 1),
 	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
 	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SYS_fcntl, 0, 1),