Merge pull request #25567 from justincormack/name_to_handle_at

Gate name_to_handle_at by CAP_SYS_ADMIN not CAP_DAC_READ_SEARCH
Upstream-commit: 19a3289250e5b22081439659d34f8bd4266ed0a3
Component: engine

components/engine/profiles/seccomp/seccomp_default.go

@@ -1667,11 +1667,6 @@ func DefaultProfile(rs *specs.Spec) *types.Seccomp {
 		switch cap {
 		case "CAP_DAC_READ_SEARCH":
 			syscalls = append(syscalls, []*types.Syscall{
-				{
-					Name:   "name_to_handle_at",
-					Action: types.ActAllow,
-					Args:   []*types.Arg{},
-				},
 				{
 					Name:   "open_by_handle_at",
 					Action: types.ActAllow,
@@ -1706,6 +1701,11 @@ func DefaultProfile(rs *specs.Spec) *types.Seccomp {
 					Action: types.ActAllow,
 					Args:   []*types.Arg{},
 				},
+				{
+					Name:   "name_to_handle_at",
+					Action: types.ActAllow,
+					Args:   []*types.Arg{},
+				},
 				{
 					Name:   "perf_event_open",
 					Action: types.ActAllow,