analyze security: fix recursive call of syscall_names_in_filter()

When `syscall_names_in_filter()` is called in itself, it is already
examined with `whitelist`. Or, in other words, `syscall_names_in_filter()`
returns bad or good in boolean. So, the returned value should not be
compared with `whitelist` again.

This replaces #11302.

diff --git a/src/analyze/analyze-security.c b/src/analyze/analyze-security.c
index 3c732b712db8a8d48effa821d1a38c9f39546145..a007ed1da47021777d412a4168a204089d105307 100644 (file)
--- a/src/analyze/analyze-security.c
+++ b/src/analyze/analyze-security.c
@@ -485,24 +485,24 @@ static bool syscall_names_in_filter(Set *s, bool whitelist, const SyscallFilterS
         const char *syscall;
 
         NULSTR_FOREACH(syscall, f->value) {
         const char *syscall;
 
         NULSTR_FOREACH(syscall, f->value) {

-                bool b;
+                int id;

 
                 if (syscall[0] == '@') {
                         const SyscallFilterSet *g;
 
                 if (syscall[0] == '@') {
                         const SyscallFilterSet *g;

-                        assert_se(g = syscall_filter_set_find(syscall));
-                        b = syscall_names_in_filter(s, whitelist, g);
-                } else {
-                        int id;

 
 

-                        /* Let's see if the system call actually exists on this platform, before complaining */
-                        id = seccomp_syscall_resolve_name(syscall);
-                        if (id < 0)
-                                continue;
+                        assert_se(g = syscall_filter_set_find(syscall));
+                        if (syscall_names_in_filter(s, whitelist, g))
+                                return true; /* bad! */

 
 

-                        b = set_contains(s, syscall);
+                        continue;

                 }
 
                 }
 

-                if (whitelist == b) {
+                /* Let's see if the system call actually exists on this platform, before complaining */
+                id = seccomp_syscall_resolve_name(syscall);
+                if (id < 0)
+                        continue;
+
+                if (set_contains(s, syscall) == whitelist) {

                         log_debug("Offending syscall filter item: %s", syscall);
                         return true; /* bad! */
                 }
                         log_debug("Offending syscall filter item: %s", syscall);
                         return true; /* bad! */
                 }