From e11f7e04e3ac2e5468f89b86b0ebee0ffe94f264 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 6 Jan 2026 15:02:16 +0000 Subject: [PATCH 1/4] Build(deps): bump dependabot/fetch-metadata from 2.4.0 to 2.5.0 Bumps [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata) from 2.4.0 to 2.5.0. - [Release notes](https://github.com/dependabot/fetch-metadata/releases) - [Commits](https://github.com/dependabot/fetch-metadata/compare/v2.4.0...v2.5.0) --- updated-dependencies: - dependency-name: dependabot/fetch-metadata dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/auto-merge-dependabot.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/auto-merge-dependabot.yml b/.github/workflows/auto-merge-dependabot.yml index 891a3a4ef..64e287ff6 100644 --- a/.github/workflows/auto-merge-dependabot.yml +++ b/.github/workflows/auto-merge-dependabot.yml @@ -13,7 +13,7 @@ jobs: steps: - name: Dependabot metadata id: metadata - uses: dependabot/fetch-metadata@v2.4.0 + uses: dependabot/fetch-metadata@v2.5.0 with: github-token: "${{ secrets.GITHUB_TOKEN }}" - name: Enable auto-merge for Dependabot PRs From b02782ca726241873ea1729084241483b8291876 Mon Sep 17 00:00:00 2001 From: macbre Date: Tue, 6 Jan 2026 15:14:11 +0000 Subject: [PATCH 2/4] chrome-secomp: add openat2 Fixes: docker: Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error closing exec fds: get handle to /proc/thread-self/fd: unsafe procfs detected: openat2 fsmount:fscontext:proc/thread-self/fd/: function not implemented See https://forums.docker.com/t/unable-to-start-container-process/150457 --- chrome-seccomp.json | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/chrome-seccomp.json b/chrome-seccomp.json index e5b0f2d68..b44f09b8a 100644 --- a/chrome-seccomp.json +++ b/chrome-seccomp.json @@ -826,6 +826,11 @@ "action": "SCMP_ACT_ALLOW", "args": null }, + { + "name": "openat2", + "action": "SCMP_ACT_ALLOW", + "args": null + }, { "name": "pause", "action": "SCMP_ACT_ALLOW", From 80ee449e71eb11f33eff29ce0238f7d1c774e8b8 Mon Sep 17 00:00:00 2001 From: macbre Date: Tue, 6 Jan 2026 15:35:41 +0000 Subject: [PATCH 3/4] chrome-seccomp.json: log not allowed syscalls instead of blocking --- chrome-seccomp.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/chrome-seccomp.json b/chrome-seccomp.json index b44f09b8a..40a228cbe 100644 --- a/chrome-seccomp.json +++ b/chrome-seccomp.json @@ -1,5 +1,5 @@ { - "defaultAction": "SCMP_ACT_ERRNO", + "defaultAction": "SCMP_ACT_LOG", "syscalls": [ { "name": "accept", From 782902d7413cb1806f815c154b66998e736a1ed6 Mon Sep 17 00:00:00 2001 From: macbre Date: Tue, 6 Jan 2026 16:02:07 +0000 Subject: [PATCH 4/4] chrome-secomp: add statx Fixes docker: Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error closing exec fds: get handle to /proc/thread-self/fd: reopen fsmount:fscontext:proc/thread-self/fd/: check safety of /proc/thread-self/fd/8 magiclink: get root mount id: statx(STATX_MNT_ID_...) fsmount:fscontext:proc/: could not get mount id: operation not permitted --- chrome-seccomp.json | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/chrome-seccomp.json b/chrome-seccomp.json index 40a228cbe..0a39a6c73 100644 --- a/chrome-seccomp.json +++ b/chrome-seccomp.json @@ -1,5 +1,5 @@ { - "defaultAction": "SCMP_ACT_LOG", + "defaultAction": "SCMP_ACT_ERRNO", "syscalls": [ { "name": "accept", @@ -1346,6 +1346,11 @@ "action": "SCMP_ACT_ALLOW", "args": null }, + { + "name": "statx", + "action": "SCMP_ACT_ALLOW", + "args": null + }, { "name": "symlink", "action": "SCMP_ACT_ALLOW",