seccomp: whitelist SYS_getrandom
We might not need the one coming from `clap`, but we still need it for
MMDS because MMDS uses hashmaps and hashmaps in Rust do SYS_getrandom
for the hash function's random seed.
@@ -158,6 +158,7 @@ pub fn default_context() -> Result<SeccompFilterContext, Error> {
and![Cond::new(1, Eq, FUTEX_REQUEUE_PRIVATE)?],
],
),
+ allow_syscall(libc::SYS_getrandom),
allow_syscall_if(libc::SYS_ioctl, create_ioctl_seccomp_rule()?),
allow_syscall(libc::SYS_lseek),
#[cfg(target_env = "musl")]
