45 lines
2.2 KiB
Diff
45 lines
2.2 KiB
Diff
# UNDF: UNDF-2026-000001229
|
|
# UNDF: UNDF-PENDING
|
|
--- a/src/shared/seccomp-util.c
|
|
+++ b/src/shared/seccomp-util.c
|
|
@@ -1178,7 +1178,7 @@ int seccomp_load_syscall_filter_set(uint32_t default_action, const SyscallFilter
|
|
|
|
SECCOMP_FOREACH_LOCAL_ARCH(arch) {
|
|
_cleanup_(seccomp_releasep) scmp_filter_ctx seccomp = NULL;
|
|
- _cleanup_strv_free_ char **added = NULL;
|
|
+ _cleanup_strv_free_ char **added = NULL;
|
|
+ _cleanup_set_free_ Set *added_set = NULL;
|
|
|
|
log_trace("Operating on architecture: %s", seccomp_arch_to_string(arch));
|
|
|
|
@@ -1188,10 +1188,20 @@ int seccomp_load_syscall_filter_set(uint32_t default_action, const SyscallFilter
|
|
if (r < 0)
|
|
return log_debug_errno(r, "Failed to add filter set: %m");
|
|
|
|
+ /* Build O(1) lookup set from the added strv to avoid O(K*A) quadratic
|
|
+ * scan in the NULSTR_FOREACH loop below. The sibling function
|
|
+ * seccomp_load_syscall_filter_set_raw() already uses hashmap_contains
|
|
+ * for O(1); this brings the named-set path in line with it. */
|
|
+ if (default_action != default_action_override) {
|
|
+ char **n;
|
|
+ STRV_FOREACH(n, added) {
|
|
+ r = set_put_strdup(&added_set, *n);
|
|
+ if (r < 0)
|
|
+ return log_oom();
|
|
+ }
|
|
+ }
|
|
+
|
|
if (default_action != default_action_override)
|
|
NULSTR_FOREACH(name, syscall_filter_sets[SYSCALL_FILTER_SET_KNOWN].value) {
|
|
int id;
|
|
|
|
id = sym_seccomp_syscall_resolve_name(name);
|
|
if (id < 0)
|
|
continue;
|
|
|
|
/* Ignore the syscall if it was already handled above */
|
|
- if (strv_contains(added, name))
|
|
+ if (set_contains(added_set, name))
|
|
continue;
|
|
|
|
r = sym_seccomp_rule_add_exact(seccomp, default_action, id, 0);
|