diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-01-25 13:19:38 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-01-25 13:19:38 +0900 |
| commit | 7b96cd6ded2668b04c908737ff393b805d34cc5c (patch) | |
| tree | b78c76a9ca30efd78ca2cd6caf8b9b2c55bc80c1 | |
| parent | 163f15e93f009d15ecc2f93932e26728aff9904b (diff) | |
helper/seccomp: do not call F_println if not verbose
This (slightly) improves performance.
Signed-off-by: Ophestra <cat@gensokyo.uk>
| -rw-r--r-- | helper/bwrap/seccomp.go (renamed from helper/bwrap/seccomp-resolve.go) | 0 | ||||
| -rw-r--r-- | helper/seccomp/seccomp-export.c | 2 | ||||
| -rw-r--r-- | helper/seccomp/seccomp-export.h | 17 | ||||
| -rw-r--r-- | helper/seccomp/seccomp.go | 7 |
4 files changed, 17 insertions, 9 deletions
diff --git a/helper/bwrap/seccomp-resolve.go b/helper/bwrap/seccomp.go index 860d720b..860d720b 100644 --- a/helper/bwrap/seccomp-resolve.go +++ b/helper/bwrap/seccomp.go diff --git a/helper/seccomp/seccomp-export.c b/helper/seccomp/seccomp-export.c index 78d27e0b..855c3bf0 100644 --- a/helper/seccomp/seccomp-export.c +++ b/helper/seccomp/seccomp-export.c @@ -28,7 +28,7 @@ struct f_syscall_act { #define LEN(arr) (sizeof(arr) / sizeof((arr)[0])) #define SECCOMP_RULESET_ADD(ruleset) do { \ - F_println("adding seccomp ruleset \"" #ruleset "\""); \ + if (opts & F_VERBOSE) F_println("adding seccomp ruleset \"" #ruleset "\""); \ for (int i = 0; i < LEN(ruleset); i++) { \ assert(ruleset[i].m_errno == EPERM || ruleset[i].m_errno == ENOSYS); \ \ diff --git a/helper/seccomp/seccomp-export.h b/helper/seccomp/seccomp-export.h index 90640d8f..3a28b127 100644 --- a/helper/seccomp/seccomp-export.h +++ b/helper/seccomp/seccomp-export.h @@ -8,14 +8,15 @@ #endif typedef enum { - F_EXT = 1 << 0, - F_DENY_NS = 1 << 1, - F_DENY_TTY = 1 << 2, - F_DENY_DEVEL = 1 << 3, - F_MULTIARCH = 1 << 4, - F_LINUX32 = 1 << 5, - F_CAN = 1 << 6, - F_BLUETOOTH = 1 << 7, + F_VERBOSE = 1 << 0, + F_EXT = 1 << 1, + F_DENY_NS = 1 << 2, + F_DENY_TTY = 1 << 3, + F_DENY_DEVEL = 1 << 4, + F_MULTIARCH = 1 << 5, + F_LINUX32 = 1 << 6, + F_CAN = 1 << 7, + F_BLUETOOTH = 1 << 8, } f_syscall_opts; extern void F_println(char *v); diff --git a/helper/seccomp/seccomp.go b/helper/seccomp/seccomp.go index b3294672..ed13118a 100644 --- a/helper/seccomp/seccomp.go +++ b/helper/seccomp/seccomp.go @@ -28,6 +28,7 @@ var resErr = [...]error{ type SyscallOpts = C.f_syscall_opts const ( + flagVerbose SyscallOpts = C.F_VERBOSE FlagExt SyscallOpts = C.F_EXT FlagDenyNS SyscallOpts = C.F_DENY_NS FlagDenyTTY SyscallOpts = C.F_DENY_TTY @@ -64,6 +65,12 @@ func exportFilter(fd uintptr, opts SyscallOpts) error { multiarch = C.SCMP_ARCH_ARM } + // this removes repeated transitions between C and Go execution + // when producing log output via F_println and CPrintln is nil + if CPrintln != nil { + opts |= flagVerbose + } + res, err := C.f_export_bpf(C.int(fd), arch, multiarch, opts) if re := resErr[res]; re != nil { if err == nil { |