Block bpf syscall from default seccomp profile
Block bpf syscall from default seccomp profile

The bpf syscall can load code into the kernel which may
persist beyond container lifecycle. Requires CAP_SYS_ADMIN
already.

Signed-off-by: Justin Cormack <af64ee19f04db9509cb02b0e470e11e5402ef9b3@unikernel.com>

sarnautov/moby,nguyentm83/docker,HideoYamauchi/docker,jimjag/docker,aditirajagopal/docker,vdemeester/docker,geekylucas/docker,cyphar/docker,jzwlqx/denverdino.github.io,yp-engineering/docker,coolljt0725/docker,softprops/docker,Mokolea/docker,brahmaroutu/docker,scollier/docker,hallyn/docker,erikh/docker,sanscontext/docker.github.io,anujbahuguna/docker,hyperhq/hypercli,akira-baruah/docker,rkazak/docker,msabansal/docker,djs55/docker,Collinux/docker,shhsu/docker,dsheets/moby,q384566678/docker,ndeloof/docker,xiekeyang/docker,nguyentm83/docker,KarthikNayak/docker,Mashimiao/docker,yp-engineering/docker,icaoweiwei/docker,denverdino/docker.github.io,gjaskiewicz/moby,stevvooe/docker,mtrmac/docker,gnailuy/docker,cloudflare/docker,ibuildthecloud/docker,imkin/moby,moby/moby,cmehay/docker-1,BrianBland/docker,joeuo/docker.github.io,pyotr777/docker,mkumatag/docker,phiroict/docker,toli/docker,hyperhq/hypercli,dnephin/docker,zhuguihua/docker,Collinux/docker,fangyuan930917/docker,charleswhchan/docker,flavio/docker,LuisBosquez/docker.github.io,sanjeo/docker,ivansaracino/docker,moypray/docker,asbjornenge/docker,darrenstahlmsft/docker,gdevillele/docker.github.io,coreos/docker,lixiaobing10051267/docker,menglingwei/denverdino.github.io,whuwxl/docker,sanscontext/docker.github.io,nawawi/docker,zhangjianfnst/docker,cnaize/docker,thtanaka/docker,ncdc/docker,moul/docker,ibuildthecloud/docker,ItsVeryWindy/docker,jhorwit2/docker,darrenstahlmsft/moby,DoraALin/docker,BenHall/docker,yasiramin10p/moby,docker/docker.github.io,jhorwit2/docker,DoraALin/docker,HackToday/docker,Akasurde/docker,jwhonce/docker,noxiouz/docker,michelvocks/docker,scotttlin/docker,AkihiroSuda/docker,Altiscale/docker,sarnautov/moby,mstanleyjones/docker,eskaaren/docker,erikstmartin/docker,clintonskitson/docker,afein/docker,mathewkoshy493/docker,londoncalling/docker.github.io,joeuo/docker.github.io,Syntaxide/docker,liaoqingwei/docker,mssola/docker,sdurrheimer/docker,Tenk42/docker,ItsVeryWindy/docker,arun-gupta/docker,ZJUshuaizhou/docker,nawawi/docker,POLJM242/docker,Jimmy-Xu/hypercli,tklauser/docker,sterchelen/docker,noironetworks/docker,inatatsu/docker,jimjag/docker,flavio/docker,tianon/docker,stevvooe/docker,joaofnfernandes/docker.github.io,mahak/docker,cnaize/docker,tmp6154/docker,xuxinkun/docker,pramodhkp/moby,mohmost12/docker,PatrickLang/moby,ffoysal/docker,icaoweiwei/docker,cnaize/docker,harche/docker,contiv/docker,carolfh/docker,dperny/docker,jlebon/docker,alfred-landrum/docker,crosbymichael/docker,portworx/docker,x1022as/docker,sunyuan3/docker,clintonskitson/docker,jameszhan/docker,fangyuan930917/docker,catinthesky/docker,isubuz/docker,geekylucas/docker,mike1729/docker,inatatsu/docker,sdurrheimer/docker,rancher/docker,sanscontext/docker.github.io,Morsicus/docker,fcrisciani/docker,yongtang/docker,konstruktoid/docker-upstream,runcom/docker,moypray/docker,ndeloof/docker,asbjornenge/docker,Altiscale/docker,coolljt0725/docker,darrenstahlmsft/moby,medallia/docker,sallyom/docker,charleswhchan/docker,xiaods/docker,shhsu/docker,aidanhs/docker,ckeyer/docker,JimGalasyn/docker.github.io,sunyuan3/docker,maxamillion/docker,shubheksha/docker.github.io,vijaykilari/docker,yummypeng/docker,14rcole/docker,kolyshkin/moby,erikstmartin/docker,isubuz/docker,mtesselH/docker,endocode/docker,dmcgowan/docker,bearstech/moby,ColinHebert/docker,jimjag/docker,jlhawn/docker,fsoppelsa/docker,dperny/docker,nghiant2710/docker,x1022as/docker,hyperhq/hypercli,aidanhs/docker,dsheets/moby,Akasurde/docker,jvanz/docker,nigelpoulton/docker,michelvocks/docker,mathewkoshy493/docker,erikstmartin/docker,darrenstahlmsft/docker,qudongfang/docker,aduermael/docker.github.io,justyntemme/docker,shin-/docker.github.io,upmio/docker,paralin/docker,sallyom/docker,srust/docker,LuisBosquez/docker.github.io,mohmost12/docker,jvanz/docker,tophj-ibm/moby,TheBigBear/docker,kojiromike/docker,SvenDowideit/docker,clintonskitson/docker,ibuildthecloud/docker,pramodhkp/moby,mgoelzer/docker,trebonian/docker,bdwill/docker.github.io,erikh/docker,sunyuan3/docker,HuKeping/docker,madhanrm/docker,portworx/docker,icaoweiwei/docker,dims/docker,scotttlin/docker,solganik/docker,nalind/docker,hqhq/moby,konstruktoid/docker-upstream,mahak/docker,tklauser/docker,errordeveloper/docker,justincormack/docker,Morsicus/docker,sterchelen/docker,laijs/docker,solganik/docker,johnstep/moby-moby,cloudflare/docker,michael-holzheu/docker,docker/docker.github.io,bonczj/moby-json-file-logger,mike1729/docker,lixiaobing10051267/docker,izarov/docker,crosbymichael/docker,containers/storage,ndeloof/docker,menglingwei/denverdino.github.io,shin-/docker.github.io,thaJeztah/docker.github.io,qudongfang/docker,maxamillion/docker,shishir-a412ed/docker,sfsmithcha/docker,xuxinkun/docker,docker-zh/docker.github.io,rremer/moby,menglingwei/denverdino.github.io,konstruktoid/docker-1,gigidwan/docker,ncdc/docker,jlebon/docker,cmehay/docker-1,dgageot/docker,errordeveloper/docker,docker/docker.github.io,tophj-ibm/docker,AkihiroSuda/docker,lixiaobing1/docker,csfrancis/docker,q384566678/docker,gdevillele/docker.github.io,srust/docker,Shopify/docker,johnstep/docker.github.io,kunalkushwaha/docker,gdevillele/docker.github.io,imeoer/hypercli,mikebrow/docker,mikebrow/docker,13W/docker,cyli/docker,YujiOshima/docker,YuPengZTE/docker,tagomoris/docker,achanda/docker,charleszheng44/moby,endophage/docker,vijaykilari/docker,dccurtis/docker,ckeyer/docker,projectatomic/docker,13W/docker,Ramzec/docker,ktraghavendra/docker,harche/docker,raja-sami-10p/moby,bdwill/docker.github.io,dgageot/docker,mkumatag/docker,anweiss/docker.github.io,laijs/moby,duglin/docker,docker-zh/docker.github.io,moxiegirl/docker,stainboy/docker,eskaaren/docker,ripcurld0/moby,nalind/docker,justyntemme/docker,Microsoft/docker,gigidwan/docker,crosbymichael/docker,bfirsh/docker,tonistiigi/docker,moxiegirl/docker,Mokolea/docker,JeffBellegarde/docker,13W/docker,yosifkit/docker,laijs/docker,SaiedKazemi/docker,yasiramin10p/moby,erikh/docker,tagomoris/docker,YujiOshima/docker,icecrime/docker,cpuguy83/docker,alexisbellido/docker.github.io,ajneu/docker,joeuo/docker.github.io,rancher/docker,prertik/docker,nghiant2710/docker,jameszhan/docker,tkopczynski/docker,Ramzec/docker,swasd/baleno,mtanlee/docker,rhatdan/storage,kerneltime/docker,jzwlqx/denverdino.github.io,nawawi/docker,willmtemple/docker,yongtang/docker,kojiromike/docker,alexisbellido/docker.github.io,Test-Betta-Inc/psychic-barnacle,upmio/docker,jlhawn/docker,skatsuta/docker,wenchma/docker,skatsuta/docker,jecarey/docker,supasate/docker,haveatry/docker,tonistiigi/docker,liaoqingwei/docker,jloehel/docker,imeoer/hypercli,nawawi/docker,arun-gupta/docker,tmp6154/docker,Mashimiao/docker,jvanz/docker,resin-io/docker,Test-Betta-Inc/psychic-barnacle,jc-m/docker,mikedougherty/docker,dperny/docker,bfirsh/docker,inatatsu/docker,gjaskiewicz/moby,phiroict/docker,splunk/docker,tkopczynski/docker,davinashreddy/docker,mbanikazemi/docker,gao-feng/docker,ibuildthecloud/docker,kerneltime/docker,michelvocks/docker,moby/moby,danyalKhaliq10p/moby,LaynePeng/docker,pecameron/docker,hustcat/docker,maxamillion/docker,ajneu/docker,coreos/docker,icecrime/docker,SaiedKazemi/docker,rhardih/docker,tianon/docker,shubheksha/docker.github.io,pradipd/moby,thaJeztah/docker,justyntemme/docker,joeuo/docker.github.io,splunk/docker,sterchelen/docker,hustcat/docker,phiroict/docker,contiv/docker,mtrmac/docker,mahak/docker,danix800/docker.github.io,yasiramin10p/moby,cpuguy83/docker,HackToday/docker,denverdino/docker.github.io,madhanrm/docker,fsoppelsa/docker,paralin/docker,sanscontext/docker.github.io,denverdino/denverdino.github.io,dongjoon-hyun/docker,twaugh/docker,nigelpoulton/docker,OnePaaS/docker,laijs/moby,Microsoft/docker,dccurtis/docker,supasate/docker,joaofnfernandes/docker.github.io,catinthesky/docker,containers/storage,tkopczynski/docker,bonczj/moby-json-file-logger,swasd/baleno,cr7pt0gr4ph7/docker,yosifkit/docker,rhatdan/storage,joaofnfernandes/docker.github.io,anortef/docker,thaJeztah/docker,charleszheng44/moby,trebonian/docker,Test-Betta-Inc/psychic-barnacle,Aegeaner/docker,phiroict/docker,johnstep/moby-moby,splunk/docker,KarthikNayak/docker,umerazad/docker,kencochrane/docker,tpounds/docker,cmehay/docker-1,naveed-jamil-tenpearls/moby,sean-jc/docker,sdurrheimer/docker,kolyshkin/docker,shubheksha/docker.github.io,ncdc/docker,gnailuy/docker,luxas/docker,joeuo/docker.github.io,YuPengZTE/docker,rillig/docker.github.io,kencochrane/docker,kunalkushwaha/docker,KarthikNayak/docker,medallia/docker,rhatdan/docker,LaynePeng/docker,JeffBellegarde/docker,sanjeo/docker,michael-holzheu/docker,miminar/docker,AkihiroSuda/docker,KingEmet/docker,laijs/docker,bonczj/moby-json-file-logger,dmcgowan/docker,sheimi/docker,shishir-a412ed/docker,kolyshkin/moby,mssola/docker,jzwlqx/denverdino.github.io,afein/docker,sarnautov/moby,BenHall/docker,laijs/moby,KingEmet/docker,TrumanLing/docker,Morsicus/docker,rremer/moby,xiaods/docker,containers/storage,kolyshkin/docker,anortef/docker,danix800/docker.github.io,raja-sami-10p/moby,13W/docker,ripcurld0/moby,noxiouz/docker,aditirajagopal/docker,raja-sami-10p/moby,denverdino/denverdino.github.io,JimGalasyn/docker.github.io,thtanaka/docker,stainboy/docker,tophj-ibm/moby,twaugh/docker,estesp/docker,dsau/docker,thaJeztah/docker.github.io,izarov/docker,jloehel/docker,umerazad/docker,rillig/docker.github.io,estesp/docker,anujbahuguna/docker,kyle-wang/docker,resin-io/docker,Tenk42/docker,sheimi/docker,hqhq/moby,cyli/docker,DoraALin/docker,tmp6154/docker,rhardih/docker,isubuz/docker,mtesselH/docker,LuisBosquez/docker.github.io,ZJUshuaizhou/docker,cyphar/docker,JimGalasyn/docker.github.io,rancher/docker,hallyn/docker,csfrancis/docker,asbjornenge/docker,carolfh/docker,kimh/docker,jloehel/docker,Shopify/docker,prertik/docker,prertik/docker,jongiddy/docker,BrianBland/docker,joaofnfernandes/docker.github.io,vincentwoo/docker,mtesselH/docker,arun-gupta/docker,POLJM242/docker,jecarey/docker,cyli/docker,amatsus/docker,paralin/docker,johnstep/docker.github.io,mbanikazemi/docker,mstanleyjones/docker,bfirsh/docker,vincentwoo/docker,troy0820/docker.github.io,hypriot/docker,michael-holzheu/docker,johnstep/docker.github.io,kyle-wang/docker,moul/docker,vdemeester/docker,pecameron/docker,upmio/docker,dsheets/moby,14rcole/docker,rillig/docker.github.io,konstruktoid/docker-1,bdwill/docker.github.io,ajaymdesai/docker,thtanaka/docker,toli/docker,londoncalling/docker.github.io,catinthesky/docker,Ramzec/docker,dsau/docker,pyotr777/docker,noironetworks/docker,medallia/docker,lixiaobing1/docker,achanda/docker,x1022as/docker,konstruktoid/docker-upstream,coreos/docker,achanda/docker,sfsmithcha/docker,zhangjianfnst/docker,hallyn/docker,johnstep/moby-moby,unclejack/docker,tophj-ibm/docker,yosifkit/docker,PatrickLang/moby,Mokolea/docker,sean-jc/docker,rillig/docker.github.io,allencloud/docker,noxiouz/docker,thaJeztah/docker,lixiaobing1/docker,YuPengZTE/docker,londoncalling/docker.github.io,sean-jc/docker,denverdino/denverdino.github.io,troy0820/docker.github.io,docker-zh/docker.github.io,xuxinkun/docker,runcom/docker,mathewkoshy493/docker,yosifkit/docker,aidanhs/docker,djs55/docker,mgoelzer/docker,gdevillele/docker.github.io,estesp/docker,bluebreezecf/docker,cr7pt0gr4ph7/docker,jlhawn/docker,denverdino/denverdino.github.io,izarov/docker,JMesser81/docker,JMesser81/docker,ZJUshuaizhou/docker,mikebrow/docker,alexisbellido/docker.github.io,mgoelzer/docker,stevvooe/docker,SvenDowideit/docker,xiaods/docker,csfrancis/docker,LuisBosquez/docker.github.io,cr7pt0gr4ph7/docker,troy0820/docker.github.io,tagomoris/docker,Mashimiao/docker,endophage/docker,charleswhchan/docker,contiv/docker,dnephin/docker,nigelpoulton/docker,jzwlqx/denverdino.github.io,rhatdan/storage,cloudflare/docker,KingEmet/docker,noironetworks/docker,menglingwei/denverdino.github.io,tonistiigi/docker,madhanrm/docker,kimh/docker,imeoer/hypercli,kunalkushwaha/docker,icecrime/docker,BSWANG/denverdino.github.io,lixiaobing10051267/docker,anweiss/docker.github.io,allencloud/docker,dongjoon-hyun/docker,scollier/docker,13W/docker,docker/docker,eskaaren/docker,duglin/docker,ivansaracino/docker,jimjag/docker,OnePaaS/docker,ColinHebert/docker,unclejack/docker,troy0820/docker.github.io,carolfh/docker,moul/docker,scotttlin/docker,Tenk42/docker,TheBigBear/docker,ffoysal/docker,duglin/docker,vincentwoo/docker,TheBigBear/docker,mixja/docker,shubheksha/docker.github.io,harche/docker,anweiss/docker.github.io,gschaetz/moby,kerneltime/docker,gigidwan/docker,gdevillele/docker.github.io,docker/docker.github.io,aduermael/docker.github.io,brahmaroutu/docker,whuwxl/docker,ktraghavendra/docker,miminar/docker,moxiegirl/docker,darrenstahlmsft/moby,ajaymdesai/docker,danix800/docker.github.io,wenchma/docker,toli/docker,diogomonica/docker,sallyom/docker,jc-m/docker,BSWANG/denverdino.github.io,shin-/docker.github.io,mtanlee/docker,yongtang/docker,dongjoon-hyun/docker,ajaymdesai/docker,hustcat/docker,flavio/docker,bearstech/moby,msabansal/docker,stainboy/docker,sanscontext/docker.github.io,ItsVeryWindy/docker,mstanleyjones/docker,bdwill/docker.github.io,konstruktoid/docker-upstream,projectatomic/docker,LaynePeng/docker,AkihiroSuda/docker,coolljt0725/docker,pradipd/moby,yp-engineering/docker,amatsus/docker,LuisBosquez/docker.github.io,joaofnfernandes/docker.github.io,moby/moby,danix800/docker.github.io,Collinux/docker,mssola/docker,imkin/moby,HuKeping/docker,imkin/moby,fcrisciani/docker,Jimmy-Xu/hypercli,abhinavdahiya/docker,moby/moby,Syntaxide/docker,docker-zh/docker.github.io,justincormack/docker,mixja/docker,vijaykilari/docker,BSWANG/denverdino.github.io,shin-/docker.github.io,shishir-a412ed/docker,alexisbellido/docker.github.io,Shopify/docker,wenchma/docker,abhinavdahiya/docker,q384566678/docker,Aegeaner/docker,gjaskiewicz/moby,whuwxl/docker,shubheksha/docker.github.io,JimGalasyn/docker.github.io,skatsuta/docker,HackToday/docker,vdemeester/docker,fcrisciani/docker,runcom/docker,xiekeyang/docker,moul/docker,rhatdan/docker,Microsoft/docker,kolyshkin/moby,bluebreezecf/docker,jthelin/docker,dgageot/docker,allencloud/docker,resin-io/docker,jameszhan/docker,Altiscale/docker,YujiOshima/docker,cpuguy83/docker,abhinavdahiya/docker,alfred-landrum/docker,rkazak/docker,BSWANG/denverdino.github.io,alfred-landrum/docker,aduermael/docker.github.io,pyotr777/docker,Ramzec/docker,TrumanLing/docker,willmtemple/docker,tpounds/docker,danyalKhaliq10p/moby,jongiddy/docker,hypriot/docker,menglingwei/denverdino.github.io,pramodhkp/moby,medallia/docker,swasd/baleno,alexisbellido/docker.github.io,dmcgowan/docker,moypray/docker,sanjeo/docker,HuKeping/docker,ripcurld0/moby,TrumanLing/docker,thaJeztah/docker,umerazad/docker,mixja/docker,jzwlqx/denverdino.github.io,softprops/docker,ailispaw/docker,thaJeztah/docker.github.io,ajneu/docker,xiekeyang/docker,liaoqingwei/docker,jlebon/docker,gao-feng/docker,geekylucas/docker,hypriot/docker,naveed-jamil-tenpearls/moby,willmtemple/docker,yummypeng/docker,bluebreezecf/docker,rhatdan/docker,denverdino/docker.github.io,dims/docker,denverdino/docker.github.io,cpuguy83/docker,msabansal/docker,BSWANG/denverdino.github.io,zhangjianfnst/docker,nghiant2710/docker,docker/docker,yummypeng/docker,dccurtis/docker,darrenstahlmsft/docker,ColinHebert/docker,mohmost12/docker,sheimi/docker,gnailuy/docker,JMesser81/docker,twaugh/docker,unclejack/docker,Syntaxide/docker,jongiddy/docker,haveatry/docker,anweiss/docker.github.io,ffoysal/docker,aaronlehmann/docker,thaJeztah/docker.github.io,diogomonica/docker,tklauser/docker,errordeveloper/docker,jhorwit2/docker,fsoppelsa/docker,ivansaracino/docker,pecameron/docker,JimGalasyn/docker.github.io,tpounds/docker,kencochrane/docker,dsau/docker,brahmaroutu/docker,gao-feng/docker,johnstep/docker.github.io,aaronlehmann/docker,akira-baruah/docker,justincormack/docker,afein/docker,BenHall/docker,cyphar/docker,HideoYamauchi/docker,sfsmithcha/docker,projectatomic/docker,docker/docker,amatsus/docker,endocode/docker,rremer/moby,SvenDowideit/docker,Akasurde/docker,zhuguihua/docker,jwhonce/docker,fangyuan930917/docker,docker/docker.github.io,ailispaw/docker,OnePaaS/docker,flavio/docker,mtanlee/docker,nalind/docker,aaronlehmann/docker,konstruktoid/docker-1,HideoYamauchi/docker,aduermael/docker.github.io,pradipd/moby,johnstep/docker.github.io,kyle-wang/docker,denverdino/denverdino.github.io,kojiromike/docker,naveed-jamil-tenpearls/moby,shhsu/docker,zhuguihua/docker,jwhonce/docker,mkumatag/docker,trebonian/docker,dnephin/docker,charleszheng44/moby,danyalKhaliq10p/moby,luxas/docker,solganik/docker,bearstech/moby,haveatry/docker,JeffBellegarde/docker,denverdino/docker.github.io,mike1729/docker,anujbahuguna/docker,shin-/docker.github.io,jthelin/docker,londoncalling/docker.github.io,ckeyer/docker,anortef/docker,nalind/docker,srust/docker,bearstech/moby,dims/docker,ZJU-SEL/docker,ibuildthecloud/docker,qudongfang/docker,gnailuy/docker,davinashreddy/docker,tophj-ibm/moby,djs55/docker,mtrmac/docker,phiroict/docker,gschaetz/moby,Aegeaner/docker,tophj-ibm/docker,davinashreddy/docker,mahak/docker,rkazak/docker,supasate/docker,hqhq/moby,aditirajagopal/docker,ailispaw/docker,mikedougherty/docker,portworx/docker,gschaetz/moby,Mokolea/docker,jc-m/docker,softprops/docker,luxas/docker,endophage/docker,kimh/docker,paralin/docker,thaJeztah/docker.github.io,miminar/docker,BrianBland/docker,ZJU-SEL/docker,mikedougherty/docker,ktraghavendra/docker,trebonian/docker,SaiedKazemi/docker,Jimmy-Xu/hypercli,anweiss/docker.github.io,endocode/docker,mbanikazemi/docker,londoncalling/docker.github.io,PatrickLang/moby,diogomonica/docker,bdwill/docker.github.io,docker-zh/docker.github.io