{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/beats/issues/7917","repository_url":"https://api.github.com/repos/elastic/beats","labels_url":"https://api.github.com/repos/elastic/beats/issues/7917/labels{/name}","comments_url":"https://api.github.com/repos/elastic/beats/issues/7917/comments","events_url":"https://api.github.com/repos/elastic/beats/issues/7917/events","html_url":"https://github.com/elastic/beats/pull/7917","id":348839604,"node_id":"MDExOlB1bGxSZXF1ZXN0MjA3MDk2MjYw","number":7917,"title":"Cherry-pick #7840 to 6.4: Add fcntl64 to the default seccomp policy for 32-bit binaries","user":{"login":"andrewkroh","id":4565752,"node_id":"MDQ6VXNlcjQ1NjU3NTI=","avatar_url":"https://avatars2.githubusercontent.com/u/4565752?v=4","gravatar_id":"","url":"https://api.github.com/users/andrewkroh","html_url":"https://github.com/andrewkroh","followers_url":"https://api.github.com/users/andrewkroh/followers","following_url":"https://api.github.com/users/andrewkroh/following{/other_user}","gists_url":"https://api.github.com/users/andrewkroh/gists{/gist_id}","starred_url":"https://api.github.com/users/andrewkroh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrewkroh/subscriptions","organizations_url":"https://api.github.com/users/andrewkroh/orgs","repos_url":"https://api.github.com/users/andrewkroh/repos","events_url":"https://api.github.com/users/andrewkroh/events{/privacy}","received_events_url":"https://api.github.com/users/andrewkroh/received_events","type":"User","site_admin":false},"labels":[{"id":306831030,"node_id":"MDU6TGFiZWwzMDY4MzEwMzA=","url":"https://api.github.com/repos/elastic/beats/labels/backport","name":"backport","color":"e99695","default":false},{"id":228068770,"node_id":"MDU6TGFiZWwyMjgwNjg3NzA=","url":"https://api.github.com/repos/elastic/beats/labels/review","name":"review","color":"207de5","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-08-08T18:25:22Z","updated_at":"2018-08-09T07:19:19Z","closed_at":null,"author_association":"MEMBER","pull_request":{"url":"https://api.github.com/repos/elastic/beats/pulls/7917","html_url":"https://github.com/elastic/beats/pull/7917","diff_url":"https://github.com/elastic/beats/pull/7917.diff","patch_url":"https://github.com/elastic/beats/pull/7917.patch"},"body":"Cherry-pick of PR #7840 to 6.4 branch. Original message: \n\nFixes #7839\r\n\r\nI received an error while running the 32-bit Packetbeat binary on a 64-bit Debian 9 OS.\r\n\r\n```\r\n2018-06-07T14:33:10.103Z    ERROR    instance/beat.go:714    Exiting: Sniffer main loop failed: Error starting sniffer: can't get FD flags when changing filter: Operation not permitted\r\n```\r\n\r\nWhen the error occurred this is what Auditbeat reported. 0x40000003 is i386 and 221 is fcntl64.\r\n\r\n```\r\n{\r\n  \"event\": {\r\n    \"category\": \"dac-decision\",\r\n    \"type\": \"seccomp\",\r\n    \"action\": \"violated-seccomp-policy\",\r\n    \"module\": \"auditd\"\r\n  },\r\n  \"process\": {\r\n    \"pid\": \"30690\",\r\n    \"name\": \"packetbeat\",\r\n    \"exe\": \"/beats/packetbeat/build/distributions/packetbeat-7.0.0-alpha1-SNAPSHOT-linux-x86/packetbeat\"\r\n  },\r\n  \"auditd\": {\r\n    \"data\": {\r\n      \"code\": \"0x50000\",\r\n      \"sig\": \"0\",\r\n      \"syscall\": \"221\",\r\n      \"compat\": \"1\",\r\n      \"ip\": \"0xf775ab49\",\r\n      \"arch\": \"40000003\"\r\n    }\r\n  }\r\n}\r\n```"},"comment":{"url":"https://api.github.com/repos/elastic/beats/issues/comments/411661905","html_url":"https://github.com/elastic/beats/pull/7917#issuecomment-411661905","issue_url":"https://api.github.com/repos/elastic/beats/issues/7917","id":411661905,"node_id":"MDEyOklzc3VlQ29tbWVudDQxMTY2MTkwNQ==","user":{"login":"ruflin","id":244900,"node_id":"MDQ6VXNlcjI0NDkwMA==","avatar_url":"https://avatars3.githubusercontent.com/u/244900?v=4","gravatar_id":"","url":"https://api.github.com/users/ruflin","html_url":"https://github.com/ruflin","followers_url":"https://api.github.com/users/ruflin/followers","following_url":"https://api.github.com/users/ruflin/following{/other_user}","gists_url":"https://api.github.com/users/ruflin/gists{/gist_id}","starred_url":"https://api.github.com/users/ruflin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ruflin/subscriptions","organizations_url":"https://api.github.com/users/ruflin/orgs","repos_url":"https://api.github.com/users/ruflin/repos","events_url":"https://api.github.com/users/ruflin/events{/privacy}","received_events_url":"https://api.github.com/users/ruflin/received_events","type":"User","site_admin":false},"created_at":"2018-08-09T07:19:19Z","updated_at":"2018-08-09T07:19:19Z","author_association":"COLLABORATOR","body":"jenkins, test this"}}
{"actor":{"display_login":"ruflin"}}