39 lines
1.6 KiB
Markdown
39 lines
1.6 KiB
Markdown
# UNDF: UNDF-2026-000001228
|
|
# systemd deeper scan — 2026-04-03
|
|
|
|
Source: https://github.com/systemd/systemd (depth=1)
|
|
Focus: src/shared/seccomp-util.c (missed in 2026-03-31 scan)
|
|
|
|
Prior defects:
|
|
- systemd-0001: strv_extend_strv dedup O(N^2) (src/basic/strv.c) — HIGH
|
|
- systemd-0002: unit_file_get_list states filter O(U*S) (src/shared/install.c) — MEDIUM
|
|
- systemd-0003: dbus-cgroup BPF filter strv dedup O(N^2) (src/core/dbus-cgroup.c) — LOW-MEDIUM
|
|
|
|
## MOAD-0001 (CWE-407): DEFECT — systemd-0004
|
|
|
|
`src/shared/seccomp-util.c` `seccomp_load_syscall_filter_set()`:
|
|
|
|
After processing the requested filter set (building `char **added` strv of
|
|
covered syscall names), the function iterates all ~537 KNOWN syscalls and for
|
|
each calls `strv_contains(added, name)` which is an O(|added|) linear scan.
|
|
|
|
This produces O(K * A) comparisons where:
|
|
- K = 537 KNOWN syscalls on x86\_64
|
|
- A = filter set size (200-400 for common sets like @default, @system-service)
|
|
|
|
On x86\_64 systemd processes 3 architectures (x86, x32, x86\_64):
|
|
```
|
|
3 * 537 * ~300 = ~484,000 string comparisons per service activation with SeccompFilter=
|
|
```
|
|
|
|
The sibling function `seccomp_load_syscall_filter_set_raw()` already uses
|
|
`hashmap_contains(filter, id)` for O(1) lookup. This function was left behind
|
|
when the raw variant was optimized.
|
|
|
|
**Fix:** build a `Set *added_set` from the `added` strv before the
|
|
`NULSTR_FOREACH` loop, then use `set_contains(added_set, name)` for O(1).
|
|
Complexity drops from O(K*A) to O(K+A) per architecture.
|
|
|
|
See `systemd-0004-seccomp-strv-to-set.patch` and `TICKET.md`.
|
|
|
|
## MOADs 0002-0005: carried from 2026-03-31 scan (all CLEAN)
|