Merge pull request #4991 from poettering/seccomp-fix

diff --cc man/systemd.exec.xml
Simple merge

diff --cc src/core/execute.c
index 3a7f997522ceac59ec110c6ba915f386133027df,a77edbb162eef2e313a55c871c869a06e4debb85..06a291fd39421a5a2246f0293df16a0302260dc8
--- 1/src/core/execute.c
--- 2/src/core/execute.c
+++ b/src/core/execute.c
@@@ -2942,31 -2691,22 +2729,25 @@@ static int exec_child
                          }
  
  #ifdef HAVE_SECCOMP
-                 if (context_has_address_families(context)) {
-                         r = apply_address_families(unit, context);
-                         if (r < 0) {
-                                 *exit_status = EXIT_ADDRESS_FAMILIES;
-                                 *error_message = strdup("Failed to restrict address families");
-                                 return r;
-                         }
+                 r = apply_address_families(unit, context);
+                 if (r < 0) {
+                         *exit_status = EXIT_ADDRESS_FAMILIES;
++                        *error_message = strdup("Failed to restrict address families");
+                         return r;
                  }
  
-                 if (context->memory_deny_write_execute) {
-                         r = apply_memory_deny_write_execute(unit, context);
-                         if (r < 0) {
-                                 *exit_status = EXIT_SECCOMP;
-                                 *error_message = strdup("Failed to disable writing to executable memory");
-                                 return r;
-                         }
+                 r = apply_memory_deny_write_execute(unit, context);
+                 if (r < 0) {
+                         *exit_status = EXIT_SECCOMP;
++                        *error_message = strdup("Failed to disable writing to executable memory");
+                         return r;
                  }
  
-                 if (context->restrict_realtime) {
-                         r = apply_restrict_realtime(unit, context);
-                         if (r < 0) {
-                                 *exit_status = EXIT_SECCOMP;
-                                 *error_message = strdup("Failed to apply realtime restrictions");
-                                 return r;
-                         }
+                 r = apply_restrict_realtime(unit, context);
+                 if (r < 0) {
+                         *exit_status = EXIT_SECCOMP;
++                        *error_message = strdup("Failed to apply realtime restrictions");
+                         return r;
                  }
  
                  r = apply_restrict_namespaces(unit, context);
@@@ -2976,42 -2715,36 +2757,41 @@@
                          return r;
                  }
  
-                 if (context->protect_kernel_tunables) {
-                         r = apply_protect_sysctl(unit, context);
-                         if (r < 0) {
-                                 *exit_status = EXIT_SECCOMP;
-                                 *error_message = strdup("Failed to apply sysctl restrictions");
-                                 return r;
-                         }
+                 r = apply_protect_sysctl(unit, context);
+                 if (r < 0) {
+                         *exit_status = EXIT_SECCOMP;
++                        *error_message = strdup("Failed to apply sysctl restrictions");
+                         return r;
                  }
  
-                 if (context->protect_kernel_modules) {
-                         r = apply_protect_kernel_modules(unit, context);
-                         if (r < 0) {
-                                 *exit_status = EXIT_SECCOMP;
-                                 *error_message = strdup("Failed to apply module loading restrictions");
-                                 return r;
-                         }
+                 r = apply_protect_kernel_modules(unit, context);
+                 if (r < 0) {
+                         *exit_status = EXIT_SECCOMP;
++                        *error_message = strdup("Failed to apply module loading restrictions");
+                         return r;
                  }
  
-                 if (context->private_devices) {
-                         r = apply_private_devices(unit, context);
-                         if (r < 0) {
-                                 *exit_status = EXIT_SECCOMP;
-                                 *error_message = strdup("Failed to set up private devices");
-                                 return r;
-                         }
+                 r = apply_private_devices(unit, context);
+                 if (r < 0) {
+                         *exit_status = EXIT_SECCOMP;
++                        *error_message = strdup("Failed to set up private devices");
+                         return r;
+                 }
+ 
+                 r = apply_syscall_archs(unit, context);
+                 if (r < 0) {
+                         *exit_status = EXIT_SECCOMP;
++                        *error_message = strdup("Failed to apply syscall architecture restrictions");
+                         return r;
                  }
  
                  /* This really should remain the last step before the execve(), to make sure our own code is unaffected
                   * by the filter as little as possible. */
-                 if (context_has_syscall_filters(context)) {
-                         r = apply_seccomp(unit, context);
-                         if (r < 0) {
-                                 *exit_status = EXIT_SECCOMP;
-                                 *error_message = strdup("Failed to apply syscall filters");
-                                 return r;
-                         }
+                 r = apply_syscall_filter(unit, context);
+                 if (r < 0) {
+                         *exit_status = EXIT_SECCOMP;
++                        *error_message = strdup("Failed to apply syscall filters");
+                         return r;
                  }
  #endif
          }

diff --cc src/core/main.c
Simple merge

diff --cc src/test/test-execute.c
Simple merge