From 7a1888954c4a4666150a59125c2e6c92277bb4e2 Mon Sep 17 00:00:00 2001
From: Nick Rosbrook <enr0n@ubuntu.com>
Date: Mon, 23 Feb 2026 15:25:27 -0500
Subject: [PATCH] seccomp-util: add lsm_get_self_attr and lsm_list_modules to
 @default

These syscalls are part of a newer kernel API to replace interaction
with /proc/self/attr, with the goal of allowing LSM stacking. These are
being used now by e.g. libapparmor, so should be more easily available
to services using seccomp filtering.
---
 src/shared/seccomp-util.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c
index 5719693a4f..55e3c14e44 100644
--- a/src/shared/seccomp-util.c
+++ b/src/shared/seccomp-util.c
@@ -402,6 +402,8 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
                 "gettimeofday\0"
                 "getuid\0"
                 "getuid32\0"
+                "lsm_get_self_attr\0"
+                "lsm_list_modules\0"
                 "membarrier\0"
                 "mmap\0"
                 "mmap2\0"