From 93101e7ef04fe43c9c13b405047c36850a2f5382 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= <thomas@t-8ch.de>
Date: Thu, 26 Feb 2026 18:30:32 +0100
Subject: [PATCH] nspawn: allow cachestat systemcall

cachestat(2) is essentially a better variant of mincore(2).
As mincore(2) is already allowed, also allow cachestat(2).
---
 src/nspawn/nspawn-seccomp.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/nspawn/nspawn-seccomp.c b/src/nspawn/nspawn-seccomp.c
index cf55c6c733..d85a30ee9f 100644
--- a/src/nspawn/nspawn-seccomp.c
+++ b/src/nspawn/nspawn-seccomp.c
@@ -49,6 +49,7 @@ static int add_syscall_filters(
                 /* Plus a good set of additional syscalls which are not part of any of the groups above */
                 { 0,                  "arm_fadvise64_64"             },
                 { 0,                  "brk"                          },
+                { 0,                  "cachestat"                    },
                 { 0,                  "capget"                       },
                 { 0,                  "capset"                       },
                 { 0,                  "copy_file_range"              },