Q: What is the meaning of SECCOMP_FILTER_FLAG_TSYNC for containers?

[mauriciovasquezbernal]

#1018 introduced support for specifying the seccomp flags SECCOMP_FILTER_FLAG_TSYNC, SECCOMP_FILTER_FLAG_LOG & SECCOMP_FILTER_FLAG_SPEC_ALLOW.

I agree that SECCOMP_FILTER_FLAG_LOG & SECCOMP_FILTER_FLAG_SPEC_ALLOW make sense as stated in #1018 (comment). However I'm not able to understand what is the meaning of SECCOMP_FILTER_FLAG_TSYNC in the OCI context. According to my understanding the runtime should guarantee that the seccomp filters are applied to the initial container process, whether TSYNC has to be used or not depends on if the thread calling seccomp() is the same executing the container init process or not and it's an internal implementation detail of the runtimes.

ref containers/crun#85 (comment)

@giuseppe

cc @alban @rata

[cyphar]

Yeah I'm not sure that it makes sense since it only is related to the loading mechanism of a container runtime and not the final container process. Though you could argue a correct implementation could also just ignore the flag because the user has no way of determining if the flag was actually used.

We can't remove it unfortunately (this was included in the 1.0.2 release) but we could deprecate it.