seccomp: ignore unsupported wait-kill flag probe

pacoxu · lifubang · commit 4d84a3403b12 · 2026-06-28T13:07:34.000Z
Signed-off-by: Paco Xu &lt;roollingstone@gmail.com&gt;
diff --git a/libcontainer/seccomp/patchbpf/enosys_linux.go b/libcontainer/seccomp/patchbpf/enosys_linux.go
@@ -673,7 +673,7 @@ func filterFlags(config *configs.Seccomp, filter *libseccomp.ScmpFilter) (flags
 		}
 	}
 	if apiLevel >= 7 {
-		if waitKill, err := filter.GetWaitKill(); err != nil {
+		if waitKill, err := filter.GetWaitKill(); err != nil && !errors.Is(err, unix.EINVAL) {
 			return 0, false, fmt.Errorf("unable to fetch SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV bit: %w", err)
 		} else if waitKill {
 			flags |= uint(C.C_FILTER_FLAG_WAIT_KILLABLE_RECV)

Original file line number	Diff line number	Diff line change
`@@ -673,7 +673,7 @@ func filterFlags(config configs.Seccomp, filter libseccomp.ScmpFilter) (flags`
`673`	`673`	`}`
`674`	`674`	`}`
`675`	`675`	`if apiLevel >= 7 {`
`676`		`- if waitKill, err := filter.GetWaitKill(); err != nil {`
	`676`	`+ if waitKill, err := filter.GetWaitKill(); err != nil && !errors.Is(err, unix.EINVAL) {`
`677`	`677`	`return 0, false, fmt.Errorf("unable to fetch SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV bit: %w", err)`
`678`	`678`	`} else if waitKill {`
`679`	`679`	`flags \|= uint(C.C_FILTER_FLAG_WAIT_KILLABLE_RECV)`