Repository: moby/moby (language: go)

Issue:
name_to_handle_at is gated by CAP_SYS_ADMIN and not CAP_DAC_READ_SEARCH as documented
### Description

The docs state:
> https://docs.docker.com/engine/security/seccomp/
>  name_to_handle_at | Sister syscall to open_by_handle_at. Already gated by CAP_DAC_READ_SEARCH.

But the profile does not include this syscall in the CAP_DAC_READ_SEARCH, forcing use of CAP_SYS_ADMIN if you need this syscall.

https://github.com/moby/moby/blob/e58c267d66cd9c8fc89c582047b22158c9d44db8/profiles/seccomp/default.json#L580-L588

Consequently the syscall fails with EPERM (errno -1).

### Reproduce

N/A

### Expected behavior

It should be possible to enable this syscall with `docker run --cap-add CAP_DAC_READ_SEARCH`.

### docker version

```bash
20.10.23 and e58c267d66cd9c8fc89c582047b22158c9d44db8.
```


### docker info

```bash
N/A
```


### Additional Info

_No response_


Discussion / hints:

Fix patch:
diff --git a/profiles/seccomp/default.json b/profiles/seccomp/default.json
index f361066a2f7ae..cf785ef2c0ddb 100644
--- a/profiles/seccomp/default.json
+++ b/profiles/seccomp/default.json
@@ -237,6 +237,7 @@
 				"munlock",
 				"munlockall",
 				"munmap",
+				"name_to_handle_at",
 				"nanosleep",
 				"newfstatat",
 				"_newselect",
@@ -601,7 +602,6 @@
 				"mount",
 				"mount_setattr",
 				"move_mount",
-				"name_to_handle_at",
 				"open_tree",
 				"perf_event_open",
 				"quotactl",
diff --git a/profiles/seccomp/default_linux.go b/profiles/seccomp/default_linux.go
index 1ee7d7a808b08..c9ee04167789d 100644
--- a/profiles/seccomp/default_linux.go
+++ b/profiles/seccomp/default_linux.go
@@ -229,6 +229,7 @@ func DefaultProfile() *Seccomp {
 					"munlock",
 					"munlockall",
 					"munmap",
+					"name_to_handle_at",
 					"nanosleep",
 					"newfstatat",
 					"_newselect",
@@ -592,7 +593,6 @@ func DefaultProfile() *Seccomp {
 					"mount",
 					"mount_setattr",
 					"move_mount",
-					"name_to_handle_at",
 					"open_tree",
 					"perf_event_open",
 					"quotactl",


Test patch: