From c8428d2d0612176c6db730dee17e9ef92582bb0f Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Fri, 14 Oct 2022 18:02:31 +0200 Subject: [PATCH] seccomp: drop per arch conditionalization in filter groups We list plenty of arch-specific syscalls in our filter groups, treat the s390 syscalls the same. We handle gracefully anyway if some syscall doesn't exist locally on the kernel or arch, let's rely on it. This has the benefit that "systemd-analyze" will comprehensively tell you the syscalls filtered on any arch for any arch. And less conditionalization is good anyway. --- src/shared/seccomp-util.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c index 52ee315dda7..1247da535d0 100644 --- a/src/shared/seccomp-util.c +++ b/src/shared/seccomp-util.c @@ -447,9 +447,7 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = { "pidfd_getfd\0" "ptrace\0" "rtas\0" -#if defined __s390__ || defined __s390x__ "s390_runtime_instr\0" -#endif "sys_debug_setcontext\0" }, [SYSCALL_FILTER_SET_FILE_SYSTEM] = { @@ -773,10 +771,8 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = { "pciconfig_iobase\0" "pciconfig_read\0" "pciconfig_write\0" -#if defined __s390__ || defined __s390x__ "s390_pci_mmio_read\0" "s390_pci_mmio_write\0" -#endif }, [SYSCALL_FILTER_SET_REBOOT] = { .name = "@reboot", -- 2.47.3