From 92f421f9e7171c4ded301f8168a105954196d61e Mon Sep 17 00:00:00 2001
From: Justin Cormack <justin.cormack@unikernel.com>
Date: Tue, 5 Jan 2016 14:27:32 +0000
Subject: [PATCH] Support compatible architectures with default seccomp rules

In the default seccomp rule, allow use of 32 bit syscalls on
64 bit architectures, so you can run x86 Linux images on x86_64
without disabling seccomp or using a custom rule.

Signed-off-by: Justin Cormack <justin.cormack@unikernel.com>
Upstream-commit: ca3ae72e43a0e6ad2f4f548586110c2e296ae1e9
Component: engine
---
 .../execdriver/native/seccomp_default.go      | 26 +++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/components/engine/daemon/execdriver/native/seccomp_default.go b/components/engine/daemon/execdriver/native/seccomp_default.go
index 7a03ab527a..28e715b9e3 100644
--- a/components/engine/daemon/execdriver/native/seccomp_default.go
+++ b/components/engine/daemon/execdriver/native/seccomp_default.go
@@ -6,10 +6,36 @@ import (
 	"syscall"
 
 	"github.com/opencontainers/runc/libcontainer/configs"
+	libseccomp "github.com/seccomp/libseccomp-golang"
 )
 
+func arches() []string {
+	var native, err = libseccomp.GetNativeArch()
+	if err != nil {
+		return []string{}
+	}
+	var a = native.String()
+	switch a {
+	case "amd64":
+		return []string{"amd64", "x86"}
+	case "arm64":
+		return []string{"arm64", "arm"}
+	case "mips64":
+		return []string{"mips64", "mips64n32", "mips"}
+	case "mips64n32":
+		return []string{"mips64", "mips64n32", "mips"}
+	case "mipsel64":
+		return []string{"mipsel64", "mipsel64n32", "mipsel"}
+	case "mipsel64n32":
+		return []string{"mipsel64", "mipsel64n32", "mipsel"}
+	default:
+		return []string{a}
+	}
+}
+
 var defaultSeccompProfile = &configs.Seccomp{
 	DefaultAction: configs.Errno,
+	Architectures: arches(),
 	Syscalls: []*configs.Syscall{
 		{
 			Name:   "accept",