nspawn: add @keyring to default syscall allow_list

Keyring namespacing introduced in kernel version v5.3-rc1 https://github.com/torvalds/linux/commit/c84ca912b07901be528e5184fd254fca1dddf2ac Fixes #17606
2025-02-12 08:05:11 +09:00
parent c0cc24ba42
commit 6cbd126b0b
2 changed files with 2 additions and 2 deletions
@@ -34,6 +34,7 @@ static int add_syscall_filters(
                { 0,                  "@file-system"                 },
                { 0,                  "@io-event"                    },
                { 0,                  "@ipc"                         },
+                { 0,                  "@keyring"                     },
                { 0,                  "@mount"                       },
                { 0,                  "@network-io"                  },
                { 0,                  "@process"                     },
@@ -116,7 +117,6 @@ static int add_syscall_filters(
                 * The following syscalls and groups are knowingly excluded:
                 *
                 * @cpu-emulation
-                 * @keyring           (NB: keyring is not namespaced!)
                 * @obsolete
                 * @pkey
                 * @swap