diff options
author | Lennart Poettering <lennart@poettering.net> | 2016-10-21 21:50:05 +0200 |
---|---|---|
committer | Lennart Poettering <lennart@poettering.net> | 2016-10-24 17:32:50 +0200 |
commit | 8130926d32d76193e98ba783ba932816f276bfad (patch) | |
tree | 1c2d5281da29c9cc10480e95b186d88941b1acf8 /src/nspawn | |
parent | e0f3720e399573134657458f4c8bd20c68fc092a (diff) |
core: rework syscall filter set handling
A variety of fixes:
- rename the SystemCallFilterSet structure to SyscallFilterSet. So far the main
instance of it (the syscall_filter_sets[] array) used to abbreviate
"SystemCall" as "Syscall". Let's stick to one of the two syntaxes, and not
mix and match too wildly. Let's pick the shorter name in this case, as it is
sufficiently well established to not confuse hackers reading this.
- Export explicit indexes into the syscall_filter_sets[] array via an enum.
This way, code that wants to make use of a specific filter set, can index it
directly via the enum, instead of having to search for it. This makes
apply_private_devices() in particular a lot simpler.
- Provide two new helper calls in seccomp-util.c: syscall_filter_set_find() to
find a set by its name, seccomp_add_syscall_filter_set() to add a set to a
seccomp object.
- Update SystemCallFilter= parser to use extract_first_word(). Let's work on
deprecating FOREACH_WORD_QUOTED().
- Simplify apply_private_devices() using this functionality
Diffstat (limited to 'src/nspawn')
0 files changed, 0 insertions, 0 deletions