From b52345cf088ea60f4915b21659c6ab1dd6ef0457 Mon Sep 17 00:00:00 2001
From: itpilotdk <88710986+itpilotdk@users.noreply.github.com>
Date: Wed, 8 Jul 2026 11:16:48 +0200
Subject: [PATCH] fix: add clock_gettime and clock_nanosleep to VMM seccomp
 allowlist

SYS_clock_gettime was missing from the seccomp allowlist, causing sandbox-runner to panic with EPERM on native Linux kernels.

Rust >= 1.74 changed Instant::now() on Linux to use CLOCK_BOOTTIME instead of CLOCK_MONOTONIC. Since clock_gettime was not in the allowlist at all, the seccomp filter returned EPERM, which Rust's unwrap() turned into a panic.

This only manifested on native Linux kernels (e.g. bare metal, KVM/Proxmox VMs). WSL2 does not enforce prctl(PR_SET_SECCOMP) argument filters the same way, which is why it worked there.

Fixes: sandbox-runner panics with 'Operation not permitted' on native Linux when starting microVM."
---
 launcher/src/main.rs | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/launcher/src/main.rs b/launcher/src/main.rs
index 39b1abb..5376b07 100644
--- a/launcher/src/main.rs
+++ b/launcher/src/main.rs
@@ -130,6 +130,8 @@ mod seccomp {
             libc::SYS_tgkill as u32,
             libc::SYS_getpid as u32,
             libc::SYS_getrandom as u32,
+            libc::SYS_clock_gettime as u32,
+            libc::SYS_clock_nanosleep as u32,
             libc::SYS_sched_getaffinity as u32,
             libc::SYS_sched_yield as u32,
             libc::SYS_set_robust_list as u32,