Repository: moby/moby (language: go)

Issue:
name_to_handle_at is gated by CAP_SYS_ADMIN and not CAP_DAC_READ_SEARCH as documented
### Description

The docs state:
> https://docs.docker.com/engine/security/seccomp/
>  name_to_handle_at | Sister syscall to open_by_handle_at. Already gated by CAP_DAC_READ_SEARCH.

But the profile does not include this syscall in the CAP_DAC_READ_SEARCH, forcing use of CAP_SYS_ADMIN if you need this syscall.

https://github.com/moby/moby/blob/e58c267d66cd9c8fc89c582047b22158c9d44db8/profiles/seccomp/default.json#L580-L588

Consequently the syscall fails with EPERM (errno -1).

### Reproduce

N/A

### Expected behavior

It should be possible to enable this syscall with `docker run --cap-add CAP_DAC_READ_SEARCH`.

### docker version

```bash
20.10.23 and e58c267d66cd9c8fc89c582047b22158c9d44db8.
```


### docker info

```bash
N/A
```


### Additional Info

_No response_


Discussion / hints:

Fix patch:
diff --git a/profiles/seccomp/default.json b/profiles/seccomp/default.json
index dbf1fa86f1514..bf58ad33de336 100644
--- a/profiles/seccomp/default.json
+++ b/profiles/seccomp/default.json
@@ -232,6 +232,7 @@
 				"munlock",
 				"munlockall",
 				"munmap",
+				"name_to_handle_at",
 				"nanosleep",
 				"newfstatat",
 				"_newselect",
@@ -607,7 +608,6 @@
 				"mount",
 				"mount_setattr",
 				"move_mount",
-				"name_to_handle_at",
 				"open_tree",
 				"perf_event_open",
 				"quotactl",
diff --git a/profiles/seccomp/default_linux.go b/profiles/seccomp/default_linux.go
index a7e2c8049ab15..18d8f5af941f6 100644
--- a/profiles/seccomp/default_linux.go
+++ b/profiles/seccomp/default_linux.go
@@ -227,6 +227,7 @@ func DefaultProfile() *Seccomp {
 				"munlock",
 				"munlockall",
 				"munmap",
+				"name_to_handle_at",
 				"nanosleep",
 				"newfstatat",
 				"_newselect",
@@ -540,7 +541,6 @@ func DefaultProfile() *Seccomp {
 				"mount",
 				"mount_setattr",
 				"move_mount",
-				"name_to_handle_at",
 				"open_tree",
 				"perf_event_open",
 				"quotactl",


Test patch: