trivial optimisation for seccomp-bpf

When doing arg inspection and the syscall doesn't match, skip
past the instruction that reloads the syscall into the accumulator,
since the accumulator hasn't been modified at this point.

diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
index badfee2ecb314678b09c9515d555d43dc7af5580..c1fe1f3e9554f0dae98fc7bc138e029c1fd971bd 100644 (file)
--- a/sandbox-seccomp-filter.c
+++ b/sandbox-seccomp-filter.c
@@ -81,7 +81,7 @@
        BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_ ## _nr, 0, 1), \
        BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
 #define SC_ALLOW_ARG(_nr, _arg_nr, _arg_val) \
-       BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_ ## _nr, 0, 3), \
+       BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_ ## _nr, 0, 4), \
        /* load first syscall argument */ \
        BPF_STMT(BPF_LD+BPF_W+BPF_ABS, \
            offsetof(struct seccomp_data, args[(_arg_nr)])), \