Removed syscalls open and openat from policy defined in addExecutionControlRules due to this syscalls being handled by policy defined in addFileSystemAccessRules

mikimasn · mikimasn · commit 3dbded8e32b9 · 2024-02-11T20:12:41.000+01:00
diff --git a/src/seccomp/policy/DefaultPolicy.cc b/src/seccomp/policy/DefaultPolicy.cc
@@ -42,9 +42,7 @@ void DefaultPolicy::addExecutionControlRules(bool allowFork) {
              "sigaltstack",
              "sigsuspend",
              "clock_nanosleep",
-             "open",
-             "epoll_create1",
-             "openat"});
+             "epoll_create1"});
 
     rules_.emplace_back(SeccompRule(
             "set_thread_area", action::ActionTrace([](auto& /* tracee */) {
