On 2021-07-29, Florian Weimer wrote: > * Aleksa Sarai: > > > If you update your syscall profile without knowing what you're doing, > > things will break. That will always be the case. > > But with the current syscall number dependency, this is jusy *way* too > hard. Who would think that adding close_range (#436) to the policy > would switch clone3 (#435) from ENOSYS to ENOPERM? Yeah, I expected that the Docker folks would've been aware of this when updating the profile (the maintainers were aware of the runc change at the time) so it does seem this is a bit too complicated... I think changing this to one of the older versions of the feature I had (only EPERM for syscalls that were present in Linux 3.0) is probably less likely to cause confusion, until we have the whole minimum kernel version infrastructure I mentioned. -- Aleksa Sarai Senior Software Engineer (Containers) SUSE Linux GmbH