nts: move loading of syscall filter in NTS-KE server

Load the filter after NKS_Initialise() to avoid hitting
a fcntl syscall.

Fixes: 66e097e3e644 ("nts: improve NTS-KE server/client code")

diff --git a/nts_ke_server.c b/nts_ke_server.c
index 1049da00a0eed18c801c3faf6e1ab0b9c098fce5..67500f410e07c5245fce974edb39d0db4ac2e085 100644 (file)
--- a/nts_ke_server.c
+++ b/nts_ke_server.c
@@ -641,12 +641,12 @@ run_helper(uid_t uid, gid_t gid, int scfilter_level)
   if (!geteuid() && (uid || gid))
     SYS_DropRoot(uid, gid);
 
+  NKS_Initialise();
+
   UTI_SetQuitSignalsHandler(helper_signal, 1);
   if (scfilter_level != 0)
     SYS_EnableSystemCallFilter(scfilter_level, SYS_NTSKE_HELPER);
 
-  NKS_Initialise();
-
   SCH_MainLoop();
 
   DEBUG_LOG("Helper exiting");