feat: Allow to call KVM_GET_XSAVE2

zulinx86 · zulinx86 · commit 7556037c4d86 · 2025-03-10T08:13:06.000Z
KVM_GET_XSAVE2 is called when taking a snapshot, so it has to be allowed
by seccomp filter.

Signed-off-by: Takahiro Itazuri &lt;itazur@amazon.com&gt;
diff --git a/resources/seccomp/x86_64-unknown-linux-musl.json b/resources/seccomp/x86_64-unknown-linux-musl.json
@@ -1078,6 +1078,18 @@
                     }
                 ]
             },
+            {
+                "syscall": "ioctl",
+                "args": [
+                    {
+                        "index": 1,
+                        "type": "dword",
+                        "op": "eq",
+                        "val": 2415963855,
+                        "comment": "KVM_GET_XSAVE2"
+                    }
+                ]
+            },
             {
                 "syscall": "ioctl",
                 "args": [

Original file line number	Diff line number	Diff line change
`@@ -1078,6 +1078,18 @@`
`1078`	`1078`	`}`
`1079`	`1079`	`]`
`1080`	`1080`	`},`
	`1081`	`+ {`
	`1082`	`+ "syscall": "ioctl",`
	`1083`	`+ "args": [`
	`1084`	`+ {`
	`1085`	`+ "index": 1,`
	`1086`	`+ "type": "dword",`
	`1087`	`+ "op": "eq",`
	`1088`	`+ "val": 2415963855,`
	`1089`	`+ "comment": "KVM_GET_XSAVE2"`
	`1090`	`+ }`
	`1091`	`+ ]`
	`1092`	`+ },`
`1081`	`1093`	`{`
`1082`	`1094`	`"syscall": "ioctl",`
`1083`	`1095`	`"args": [`