{"action":"created","issue":{"url":"https://api.github.com/repos/seccomp/libseccomp/issues/44","repository_url":"https://api.github.com/repos/seccomp/libseccomp","labels_url":"https://api.github.com/repos/seccomp/libseccomp/issues/44/labels{/name}","comments_url":"https://api.github.com/repos/seccomp/libseccomp/issues/44/comments","events_url":"https://api.github.com/repos/seccomp/libseccomp/issues/44/events","html_url":"https://github.com/seccomp/libseccomp/issues/44","id":164862684,"number":44,"title":"BUG: cannot add blacklist items to a whitelist","user":{"login":"justincormack","id":482364,"avatar_url":"https://avatars.githubusercontent.com/u/482364?v=3","gravatar_id":"","url":"https://api.github.com/users/justincormack","html_url":"https://github.com/justincormack","followers_url":"https://api.github.com/users/justincormack/followers","following_url":"https://api.github.com/users/justincormack/following{/other_user}","gists_url":"https://api.github.com/users/justincormack/gists{/gist_id}","starred_url":"https://api.github.com/users/justincormack/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/justincormack/subscriptions","organizations_url":"https://api.github.com/users/justincormack/orgs","repos_url":"https://api.github.com/users/justincormack/repos","events_url":"https://api.github.com/users/justincormack/events{/privacy}","received_events_url":"https://api.github.com/users/justincormack/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/seccomp/libseccomp/labels/invalid","name":"invalid","color":"e6e6e6"}],"state":"open","locked":false,"assignee":{"login":"pcmoore","id":8494929,"avatar_url":"https://avatars.githubusercontent.com/u/8494929?v=3","gravatar_id":"","url":"https://api.github.com/users/pcmoore","html_url":"https://github.com/pcmoore","followers_url":"https://api.github.com/users/pcmoore/followers","following_url":"https://api.github.com/users/pcmoore/following{/other_user}","gists_url":"https://api.github.com/users/pcmoore/gists{/gist_id}","starred_url":"https://api.github.com/users/pcmoore/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pcmoore/subscriptions","organizations_url":"https://api.github.com/users/pcmoore/orgs","repos_url":"https://api.github.com/users/pcmoore/repos","events_url":"https://api.github.com/users/pcmoore/events{/privacy}","received_events_url":"https://api.github.com/users/pcmoore/received_events","type":"User","site_admin":false},"assignees":[{"login":"pcmoore","id":8494929,"avatar_url":"https://avatars.githubusercontent.com/u/8494929?v=3","gravatar_id":"","url":"https://api.github.com/users/pcmoore","html_url":"https://github.com/pcmoore","followers_url":"https://api.github.com/users/pcmoore/followers","following_url":"https://api.github.com/users/pcmoore/following{/other_user}","gists_url":"https://api.github.com/users/pcmoore/gists{/gist_id}","starred_url":"https://api.github.com/users/pcmoore/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pcmoore/subscriptions","organizations_url":"https://api.github.com/users/pcmoore/orgs","repos_url":"https://api.github.com/users/pcmoore/repos","events_url":"https://api.github.com/users/pcmoore/events{/privacy}","received_events_url":"https://api.github.com/users/pcmoore/received_events","type":"User","site_admin":false}],"milestone":null,"comments":8,"created_at":"2016-07-11T15:16:33Z","updated_at":"2016-07-12T14:26:02Z","closed_at":null,"body":"For docker we ship a default seccomp profile that is a whitelist using `libseccomp-golang` see https://github.com/docker/docker/tree/master/profiles/seccomp\r\n\r\nHowever it seems to be impossible to have a default action of `ERRNO` and then add an `ERRNO` rule to blacklist a particular pattern as we get a `\"requested action matches default action of filter\"` error message passed through from libseccomp.\r\n\r\nWe want to block some particular argument values of a particular syscall (see https://github.com/docker/docker/pull/23893 ), so eg `setsockopt(x, 0, 41, x)` and `setsockopt(x, 0, 96, x)` and `setsockopt(x, 41, 41, x)` should be denied, while allowing any other values, but although this can easily be written with a socket filter directly, it does not seem to be possible to write with libseccomp.\r\n\r\nI was wondering if perhaps it could accept rules with the same action as the default and construct the appropriate bpf.\r\n\r\nThis is also mentioned in this issue comment, although there is  workaround in that case https://github.com/seccomp/libseccomp/issues/27#issuecomment-184778612"},"comment":{"url":"https://api.github.com/repos/seccomp/libseccomp/issues/comments/232064017","html_url":"https://github.com/seccomp/libseccomp/issues/44#issuecomment-232064017","issue_url":"https://api.github.com/repos/seccomp/libseccomp/issues/44","id":232064017,"user":{"login":"pcmoore","id":8494929,"avatar_url":"https://avatars.githubusercontent.com/u/8494929?v=3","gravatar_id":"","url":"https://api.github.com/users/pcmoore","html_url":"https://github.com/pcmoore","followers_url":"https://api.github.com/users/pcmoore/followers","following_url":"https://api.github.com/users/pcmoore/following{/other_user}","gists_url":"https://api.github.com/users/pcmoore/gists{/gist_id}","starred_url":"https://api.github.com/users/pcmoore/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pcmoore/subscriptions","organizations_url":"https://api.github.com/users/pcmoore/orgs","repos_url":"https://api.github.com/users/pcmoore/repos","events_url":"https://api.github.com/users/pcmoore/events{/privacy}","received_events_url":"https://api.github.com/users/pcmoore/received_events","type":"User","site_admin":false},"created_at":"2016-07-12T14:26:02Z","updated_at":"2016-07-12T14:26:02Z","body":"The example you provided isn't a whitelist."}}
{"actor":{"display_login":"pcmoore"}}