|
 |
984f77 |
From 64705366e134f06438e88f0b7fbef341d0a01431 Mon Sep 17 00:00:00 2001
|
|
|
984f77 |
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
|
|
|
984f77 |
Date: Wed, 19 Aug 2020 17:43:40 +0200
|
|
|
984f77 |
Subject: [PATCH] shared/seccomp: reduce scope of indexing variables
|
|
|
984f77 |
|
|
|
984f77 |
(cherry picked from commit 077e8fc0cad5a4532348d20a1eef8621295dd75a)
|
|
|
984f77 |
|
|
|
984f77 |
Related: #2040247
|
|
|
984f77 |
---
|
|
|
984f77 |
src/shared/seccomp-util.c | 14 +++++---------
|
|
|
984f77 |
1 file changed, 5 insertions(+), 9 deletions(-)
|
|
|
984f77 |
|
|
|
984f77 |
diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c
|
|
|
984f77 |
index c2b2f2da92..4d2ba31d47 100644
|
|
|
984f77 |
--- a/src/shared/seccomp-util.c
|
|
|
984f77 |
+++ b/src/shared/seccomp-util.c
|
|
|
984f77 |
@@ -864,12 +864,10 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
|
|
|
984f77 |
};
|
|
|
984f77 |
|
|
|
984f77 |
const SyscallFilterSet *syscall_filter_set_find(const char *name) {
|
|
|
984f77 |
- unsigned i;
|
|
|
984f77 |
-
|
|
|
984f77 |
if (isempty(name) || name[0] != '@')
|
|
|
984f77 |
return NULL;
|
|
|
984f77 |
|
|
|
984f77 |
- for (i = 0; i < _SYSCALL_FILTER_SET_MAX; i++)
|
|
|
984f77 |
+ for (unsigned i = 0; i < _SYSCALL_FILTER_SET_MAX; i++)
|
|
|
984f77 |
if (streq(syscall_filter_sets[i].name, name))
|
|
|
984f77 |
return syscall_filter_sets + i;
|
|
|
984f77 |
|
|
|
984f77 |
@@ -1105,7 +1103,6 @@ int seccomp_restrict_namespaces(unsigned long retain) {
|
|
|
984f77 |
|
|
|
984f77 |
SECCOMP_FOREACH_LOCAL_ARCH(arch) {
|
|
|
984f77 |
_cleanup_(seccomp_releasep) scmp_filter_ctx seccomp = NULL;
|
|
|
984f77 |
- unsigned i;
|
|
|
984f77 |
|
|
|
984f77 |
log_debug("Operating on architecture: %s", seccomp_arch_to_string(arch));
|
|
|
984f77 |
|
|
|
984f77 |
@@ -1135,7 +1132,7 @@ int seccomp_restrict_namespaces(unsigned long retain) {
|
|
|
984f77 |
continue;
|
|
|
984f77 |
}
|
|
|
984f77 |
|
|
|
984f77 |
- for (i = 0; namespace_flag_map[i].name; i++) {
|
|
|
984f77 |
+ for (unsigned i = 0; namespace_flag_map[i].name; i++) {
|
|
|
984f77 |
unsigned long f;
|
|
|
984f77 |
|
|
|
984f77 |
f = namespace_flag_map[i].flag;
|
|
|
984f77 |
@@ -1288,7 +1285,7 @@ int seccomp_restrict_address_families(Set *address_families, bool whitelist) {
|
|
|
984f77 |
return r;
|
|
|
984f77 |
|
|
|
984f77 |
if (whitelist) {
|
|
|
984f77 |
- int af, first = 0, last = 0;
|
|
|
984f77 |
+ int first = 0, last = 0;
|
|
|
984f77 |
void *afp;
|
|
|
984f77 |
|
|
|
984f77 |
/* If this is a whitelist, we first block the address families that are out of range and then
|
|
|
984f77 |
@@ -1296,7 +1293,7 @@ int seccomp_restrict_address_families(Set *address_families, bool whitelist) {
|
|
|
984f77 |
* the set. */
|
|
|
984f77 |
|
|
|
984f77 |
SET_FOREACH(afp, address_families, i) {
|
|
|
984f77 |
- af = PTR_TO_INT(afp);
|
|
|
984f77 |
+ int af = PTR_TO_INT(afp);
|
|
|
984f77 |
|
|
|
984f77 |
if (af <= 0 || af >= af_max())
|
|
|
984f77 |
continue;
|
|
|
984f77 |
@@ -1350,7 +1347,7 @@ int seccomp_restrict_address_families(Set *address_families, bool whitelist) {
|
|
|
984f77 |
}
|
|
|
984f77 |
|
|
|
984f77 |
/* Block everything between the first and last entry */
|
|
|
984f77 |
- for (af = 1; af < af_max(); af++) {
|
|
|
984f77 |
+ for (int af = 1; af < af_max(); af++) {
|
|
|
984f77 |
|
|
|
984f77 |
if (set_contains(address_families, INT_TO_PTR(af)))
|
|
|
984f77 |
continue;
|
|
|
984f77 |
@@ -1378,7 +1375,6 @@ int seccomp_restrict_address_families(Set *address_families, bool whitelist) {
|
|
|
984f77 |
* checks. */
|
|
|
984f77 |
|
|
|
984f77 |
SET_FOREACH(af, address_families, i) {
|
|
|
984f77 |
-
|
|
|
984f77 |
r = seccomp_rule_add_exact(
|
|
|
984f77 |
seccomp,
|
|
|
984f77 |
SCMP_ACT_ERRNO(EAFNOSUPPORT),
|