virtcontainers: clh: Enable the `seccomp` feature
This patch enables the `seccomp` feature from Cloud Hypervisor which
provides fine-grained allowed syscalls for each of its worker
threads. It brings important security benefits, while would increase
memory footprint.
Fixes:
@@ -947,11 +947,6 @@ func (clh *cloudHypervisor) launchClh() (int, error) {
args = append(args, "-v")
}
- // Disable the 'seccomp' option in clh for now.
- // In this way, we can separate the periodic failures caused
- // by incomplete `seccomp` filters from other failures.
- // We will bring it back after completing the `seccomp` filter.
- args = append(args, "--seccomp", "false")
clh.Logger().WithField("path", clhPath).Info()
clh.Logger().WithField("args", strings.Join(args, " ")).Info()
