From 2b616e6fe83e7cc62b0eb47a461d627c643837e4 Mon Sep 17 00:00:00 2001 From: Will Mortensen Date: Sun, 20 Sep 2026 06:51:41 +0000 Subject: [PATCH] jail: allow set_tls syscall in linker and init Otherwise 32-bit ARM breaks completely, since this is often the very first syscall. Fixes: f15d0c407c09 ("jail: apply OCI seccomp filters via ptrace syscall injection") Signed-off-by: Will Mortensen --- jail/seccomp-oci.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/jail/seccomp-oci.c b/jail/seccomp-oci.c index c14c597..bb4c454 100644 --- a/jail/seccomp-oci.c +++ b/jail/seccomp-oci.c @@ -231,13 +231,14 @@ const char * const seccomp_linker_base[] = { "fstatfs", "futex", "getrandom", "mmap", "mprotect", "munmap", "newfstatat", "open", "openat", "pread64", "prctl", "prlimit64", "read", "readlinkat", "rseq", "rt_sigaction", "sched_getscheduler", - "set_robust_list", "set_tid_address", "sigaltstack", "statfs", NULL, + "set_robust_list", "set_tid_address", "set_tls", "sigaltstack", "statfs", + NULL, }; const char * const seccomp_init_base[] = { "arch_prctl", "brk", "futex", "getrandom", "mmap", "mprotect", "munmap", "prctl", "prlimit64", "rseq", "rt_sigaction", "sched_getscheduler", - "set_robust_list", "set_tid_address", "sigaltstack", NULL, + "set_robust_list", "set_tid_address", "set_tls", "sigaltstack", NULL, }; const char * const seccomp_loader_files[] = {