Add clock_nanosleep to seccomp allowlist

Fixes elastic#33792
andrewkroh · Nov 28, 2022 · 4dac32e · 4dac32e
1 parent 4f639d7
commit 4dac32e
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 0 deletions.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -47,6 +47,7 @@ https://github.com/elastic/beats/compare/v8.2.0\...main[Check the HEAD diff]
 - Keep `orchestrator.cluster.name` if `kubeconfig` is not returned in GKE metadata. {pull}33418[33418]
 - Fix Windows service install/uninstall when Win32_Service returns error, add logic to wait until the Windows Service is stopped before proceeding. {pull}33322[33322]
 - Support for multiline zookeeper logs {issue}2496[2496]
+- Allow `clock_nanosleep` in the default seccomp profiles for amd64 and 386. Newer versions of glibc (e.g. 2.31) require it. {issue}33792[33792]
 
 *Auditbeat*
 

diff --git a/libbeat/common/seccomp/policy_linux_386.go b/libbeat/common/seccomp/policy_linux_386.go
@@ -34,6 +34,7 @@ func init() {
 					"chmod",
 					"chown",
 					"clock_gettime",
+					"clock_nanosleep",
 					"clone",
 					"clone3",
 					"close",

diff --git a/libbeat/common/seccomp/policy_linux_amd64.go b/libbeat/common/seccomp/policy_linux_amd64.go
@@ -37,6 +37,7 @@ func init() {
 					"chmod",
 					"chown",
 					"clock_gettime",
+					"clock_nanosleep",
 					"clone",
 					"clone3",
 					"close",