enosys: optimize bytecode when no ioctls are blocked

Signed-off-by: Thomas Weißschuh <thomas@t-8ch.de>

diff --git a/misc-utils/enosys.c b/misc-utils/enosys.c
index 622240001a06351cb35ea9aae114a4e420dc04c8..7c9afa768fadfb815438d5d79f27780a38c89e7c 100644 (file)
--- a/misc-utils/enosys.c
+++ b/misc-utils/enosys.c
@@ -222,17 +222,19 @@ int main(int argc, char **argv)
                INSTR(BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ERRNO | ENOSYS));
        }
 
-       INSTR(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_ioctl, 1, 0));
-       INSTR(BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW));
-
-       list_for_each(loop_ctr, &blocked_ioctls) {
-               blocked = list_entry(loop_ctr, struct blocked_number, head);
-
-               INSTR(BPF_STMT(BPF_LD | BPF_W | BPF_ABS, syscall_arg_lower32(1)));
-               INSTR(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, (uint64_t) blocked->number, 0, 3));
-               INSTR(BPF_STMT(BPF_LD | BPF_W | BPF_ABS, syscall_arg_upper32(1)));
-               INSTR(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, (uint64_t) blocked->number >> 32, 0, 1));
-               INSTR(BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ERRNO | ENOTTY));
+       if (!list_empty(&blocked_ioctls)) {
+               INSTR(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_ioctl, 1, 0));
+               INSTR(BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW));
+
+               list_for_each(loop_ctr, &blocked_ioctls) {
+                       blocked = list_entry(loop_ctr, struct blocked_number, head);
+
+                       INSTR(BPF_STMT(BPF_LD | BPF_W | BPF_ABS, syscall_arg_lower32(1)));
+                       INSTR(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, (uint64_t) blocked->number, 0, 3));
+                       INSTR(BPF_STMT(BPF_LD | BPF_W | BPF_ABS, syscall_arg_upper32(1)));
+                       INSTR(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, (uint64_t) blocked->number >> 32, 0, 1));
+                       INSTR(BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ERRNO | ENOTTY));
+               }
        }
 
        INSTR(BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW));