[PATCH v5 2/3] filter_seccomp: skip seccomp setup when there's nothing to filter

[Paul Chaignon]

On Sat, Sep 21, 2019 at 07:02:36PM +0300, Dmitry V. Levin wrote:
> From: Paul Chaignon <paul.chaignon at gmail.com>
> 
> If the trace_set set is complete (no syscalls are filtered), seccomp
> filtering is disabled.  This patch adds a new is_complete_set_array
> function to check whether all sets of a set array are complete.
> 
> * number_set.c (is_complete_set_array): New function.
> * number_set.h (is_complete_set_array): New prototype.
> * filter_seccomp.c (check_seccomp_filter): Skip seccomp setup if there is
> nothing to filter.
> 
> Signed-off-by: Paul Chaignon <paul.chaignon at gmail.com>
> ---
>  filter_seccomp.c |  6 ++++++
>  number_set.c     | 12 ++++++++++++
>  number_set.h     |  4 ++++
>  3 files changed, 22 insertions(+)
> 
> diff --git a/filter_seccomp.c b/filter_seccomp.c
> index 0fa6e84de..8361553d1 100644
> --- a/filter_seccomp.c
> +++ b/filter_seccomp.c
> @@ -613,6 +613,12 @@ seccomp_filter_restart_operator(const struct tcb *tcp)
>  void
>  check_seccomp_filter(void)
>  {
> +	/* Let's avoid enabling seccomp if all syscalls are traced. */
> +	seccomp_filtering = !is_complete_set_array(trace_set, nsyscall_vec,
> +						   SUPPORTED_PERSONALITIES);
> +	if (!seccomp_filtering)
> +		return;

I think this deserves a warning (or at least a debug message).  Otherwise
seccomp filter is silently disabled and users who want to try this new
feature out may not realize it.

[...]