seccomp: allow TUNSETOFFLOAD ioctl in the vCPU threads

Before, we were calling this ioctl() from the VMM thread when creating
the virtio network device. Moreover, this ioctl() was called before
setting up seccomp filters. Now, we call it during device activation,
which is handled by the vCPU threads. Change the seccomp filters to
allow these ioctl()s.

Signed-off-by: Babis Chalios <[email protected]>

Author: bchalios

resources/seccomp/aarch64-unknown-linux-musl.json

@@ -1038,6 +1038,18 @@
                     }
                 ]
             },
+            {
+                "syscall": "ioctl",
+                "args": [
+                    {
+                        "index": 1,
+                        "type": "dword",
+                        "op": "eq",
+                        "val": 1074025680,
+                        "comment": "TUNSETOFFLOAD"
+                    }
+                ]
+            },
             {
                 "syscall": "sched_yield",
                 "comment": "Used by the rust standard library in std::sync::mpmc. Firecracker uses mpsc channels from this module for inter-thread communication"

resources/seccomp/x86_64-unknown-linux-musl.json

@@ -1238,6 +1238,18 @@
                     }
                 ]
             },
+            {
+                "syscall": "ioctl",
+                "args": [
+                    {
+                        "index": 1,
+                        "type": "dword",
+                        "op": "eq",
+                        "val": 1074025680,
+                        "comment": "TUNSETOFFLOAD"
+                    }
+                ]
+            },
             {
                 "syscall": "sched_yield",
                 "comment": "Used by the rust standard library in std::sync::mpmc. Firecracker uses mpsc channels from this module for inter-thread communication"