seccomp-util: add cacheflush() syscall to @default syscall set

This is like membarrier() I guess and basically just exposes CPU
functionality via kernel syscall on some archs. Let's whitelist it for
everyone.

Fixes: #17197

diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c
index 358960d5c4b279c481e81a9d7a273dcb06e374b3..b22ef7cec1db7940e8a41ce91cddc41ac3cd63cd 100644 (file)
--- a/src/shared/seccomp-util.c
+++ b/src/shared/seccomp-util.c
@@ -272,6 +272,7 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
                 .name = "@default",
                 .help = "System calls that are always permitted",
                 .value =
+                "cacheflush\0"
                 "clock_getres\0"
                 "clock_getres_time64\0"
                 "clock_gettime\0"