Repository: moby/moby (language: go)

Issue:
seccomp: allow clock_settime64 under CAP_SYS_TIME
**Description**

Setting time within a container (for example using `date -s "2 OCT 2006 18:00:00"`) fails with 'Operation not permitted' if the `clock_settime64` syscall is used. I have confirmed this behavior using strace.

**Steps to reproduce the issue:**
1. Start a container with `--cap-add SYS_TIME`
2. Try to set the time with `date -s "2 OCT 2006 18:00:00"`
3. If the `clock_settime64` syscall is used, the operation fails. This can be confirmed with strace.
4. Start the same image with `--security-opt seccomp:unconfined`
5. Run `date -s "2 OCT 2006 18:00:00"`, it works

**Describe the results you received:**

'Operation not permitted' whenever `clock_settime64` is used.

**Describe the results you expected:**

Being able to set the time within the container with `--cap-add SYS_TIME`.

**Additional information you deem important (e.g. issue happens only occasionally):**

I could only reproduce this issue on ARM32 hosts. On amd64 `date` uses `clock_settime` which is currently allowed by the default seccomp profile under `SYS_TIME`.

**Output of `docker version`:**

```
Docker version 20.10.17
```


Discussion / hints:
Seems ok to me, care to open a PR?

Fix patch:
diff --git a/profiles/seccomp/default.json b/profiles/seccomp/default.json
index ed553e2d9c489..fb9c44eff7d20 100644
--- a/profiles/seccomp/default.json
+++ b/profiles/seccomp/default.json
@@ -743,7 +743,8 @@
 			"names": [
 				"settimeofday",
 				"stime",
-				"clock_settime"
+				"clock_settime",
+				"clock_settime64"
 			],
 			"action": "SCMP_ACT_ALLOW",
 			"includes": {
diff --git a/profiles/seccomp/default_linux.go b/profiles/seccomp/default_linux.go
index 1bc8ed86f0641..4e747eef8225d 100644
--- a/profiles/seccomp/default_linux.go
+++ b/profiles/seccomp/default_linux.go
@@ -731,6 +731,7 @@ func DefaultProfile() *Seccomp {
 					"settimeofday",
 					"stime",
 					"clock_settime",
+					"clock_settime64",
 				},
 				Action: specs.ActAllow,
 			},


Test patch: