russell@unturf.com
decacb5dbd
systemd-0004: seccomp_load_syscall_filter_set() in src/shared/seccomp-util.c uses strv_contains(added, name) — O(|added|) linear scan — inside NULSTR_FOREACH over ~537 KNOWN syscalls. On x86_64 (3 arches): ~484,000 string comparisons per service start with SeccompFilter=. Sibling function seccomp_load_syscall_filter_set_raw() already uses hashmap_contains for O(1); this function was left behind. Fix: build Set* from added strv before the NULSTR_FOREACH loop. MEDIUM severity. dbus-0001: bus_client_policy_optimize() in bus/policy.c iterates R rules and for each blanket deny/allow calls remove_rules_by_type_up_to() which scans backward from current position to head — O(R^2) total per new connection creation. At R=100 rules (realistic system bus): ~10,000 comparisons per connect. Fix: single O(R) reverse pass tracking last-seen blanket per rule type. MEDIUM. dbus 5-MOAD summary: MOAD-0001: dbus-0001 DEFECT (policy optimize O(R^2)) MOAD-0002: CLEAN (BusContext is standard daemon context, not a god object) MOAD-0003: CLEAN (single-threaded event loop, no thread-local state) MOAD-0004: CLEAN (_dbus_verbose is no-op in production builds) MOAD-0005: CLEAN (pending_activations hash table coalesces duplicate requests)
1.6 KiB
systemd deeper scan — 2026-04-03
Source: https://github.com/systemd/systemd (depth=1) Focus: src/shared/seccomp-util.c (missed in 2026-03-31 scan)
Prior defects:
- systemd-0001: strv_extend_strv dedup O(N^2) (src/basic/strv.c) — HIGH
- systemd-0002: unit_file_get_list states filter O(U*S) (src/shared/install.c) — MEDIUM
- systemd-0003: dbus-cgroup BPF filter strv dedup O(N^2) (src/core/dbus-cgroup.c) — LOW-MEDIUM
MOAD-0001 (CWE-407): DEFECT — systemd-0004
src/shared/seccomp-util.c seccomp_load_syscall_filter_set():
After processing the requested filter set (building char **added strv of
covered syscall names), the function iterates all ~537 KNOWN syscalls and for
each calls strv_contains(added, name) which is an O(|added|) linear scan.
This produces O(K * A) comparisons where:
- K = 537 KNOWN syscalls on x86_64
- A = filter set size (200-400 for common sets like @default, @system-service)
On x86_64 systemd processes 3 architectures (x86, x32, x86_64):
3 * 537 * ~300 = ~484,000 string comparisons per service activation with SeccompFilter=
The sibling function seccomp_load_syscall_filter_set_raw() already uses
hashmap_contains(filter, id) for O(1) lookup. This function was left behind
when the raw variant was optimized.
Fix: build a Set *added_set from the added strv before the
NULSTR_FOREACH loop, then use set_contains(added_set, name) for O(1).
Complexity drops from O(K*A) to O(K+A) per architecture.
See systemd-0004-seccomp-strv-to-set.patch and TICKET.md.