Browse code
profiles/seccomp: improve profile conversion
When translating seccomp profile to opencontainers format, a single
group with multiple syscalls is converted to individual syscall rules.
I am not sure why it is done that way, but suspect it might have
performance implications as the number of rules grows.
Change this to pass a groups of syscalls as a group.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Kir Kolyshkin authored on 2019/06/19 09:58:51Showing 1 changed files
| ... | ... |
@@ -143,20 +143,18 @@ Loop: |
| 143 | 143 |
} |
| 144 | 144 |
|
| 145 | 145 |
if call.Name != "" {
|
| 146 |
- newConfig.Syscalls = append(newConfig.Syscalls, createSpecsSyscall(call.Name, call.Action, call.Args)) |
|
| 147 |
- } |
|
| 148 |
- |
|
| 149 |
- for _, n := range call.Names {
|
|
| 150 |
- newConfig.Syscalls = append(newConfig.Syscalls, createSpecsSyscall(n, call.Action, call.Args)) |
|
| 146 |
+ newConfig.Syscalls = append(newConfig.Syscalls, createSpecsSyscall([]string{call.Name}, call.Action, call.Args))
|
|
| 147 |
+ } else {
|
|
| 148 |
+ newConfig.Syscalls = append(newConfig.Syscalls, createSpecsSyscall(call.Names, call.Action, call.Args)) |
|
| 151 | 149 |
} |
| 152 | 150 |
} |
| 153 | 151 |
|
| 154 | 152 |
return newConfig, nil |
| 155 | 153 |
} |
| 156 | 154 |
|
| 157 |
-func createSpecsSyscall(name string, action types.Action, args []*types.Arg) specs.LinuxSyscall {
|
|
| 155 |
+func createSpecsSyscall(names []string, action types.Action, args []*types.Arg) specs.LinuxSyscall {
|
|
| 158 | 156 |
newCall := specs.LinuxSyscall{
|
| 159 |
- Names: []string{name},
|
|
| 157 |
+ Names: names, |
|
| 160 | 158 |
Action: specs.LinuxSeccompAction(action), |
| 161 | 159 |
} |
| 162 | 160 |
|