adding mincore syscall to the default seccomp filter and some independent profiles

2 files changed, 5 insertions, 2 deletions

diff --git a/src/fseccomp/syscall.c b/src/fseccomp/syscall.c
index 3b10c4473..b17d86a0b 100644
--- a/src/fseccomp/syscall.c
+++ b/src/fseccomp/syscall.c
@@ -168,7 +168,10 @@ static const SyscallGroupList sysgroups[] = {
           "umount,"
 #endif
 #ifdef SYS_userfaultfd
-          "userfaultfd"
+          "userfaultfd,"
+#endif
+#ifdef SYS_mincore      // 0.9.57
+          "mincore"
 #endif
         },
         { .name = "@default-nodebuggers", .list =
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 2d0bd26d0..0d402ef36 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -1700,7 +1700,7 @@ Enable seccomp filter and blacklist the syscalls in the default list (@default).
 _sysctl, acct, add_key, adjtimex, afs_syscall, bdflush, bpf, break, chroot, clock_adjtime, clock_settime,
 create_module, delete_module, fanotify_init, finit_module, ftime, get_kernel_syms, getpmsg, gtty, init_module,
 io_cancel, io_destroy, io_getevents, io_setup, io_submit, ioperm, iopl, ioprio_set, kcmp, kexec_file_load,
-kexec_load, keyctl, lock, lookup_dcookie, mbind, migrate_pages, modify_ldt, mount, move_pages, mpx,
+kexec_load, keyctl, lock, lookup_dcookie, mbind, migrate_pages, modify_ldt, mount, mincore, move_pages, mpx,
 name_to_handle_at, nfsservctl, ni_syscall, open_by_handle_at, pciconfig_iobase, pciconfig_read, pciconfig_write, perf_event_open,
 personality, pivot_root, process_vm_readv, process_vm_writev, prof, profil, ptrace, putpmsg,
 query_module, reboot, remap_file_pages, request_key, rtas, s390_mmio_read, s390_mmio_write, s390_runtime_instr,