mirror/runc
1
0
Fork 0
mirror of https://github.com/opencontainers/runc.git synced 2026-07-11 06:03:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3405 from kolyshkin/seccomp-bintree

Browse Source 
libct/seccomp: enable seccomp binary tree optimization
This commit is contained in:
Kir Kolyshkin
2022-10-31 17:57:08 -07:00
committed by GitHub
parent 6e2b46e259 b265d1288f
commit fdc4d67cc7
1 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libcontainer/seccomp/seccomp_linux.go
+14
View File
@@ -111,6 +111,20 @@ func InitSeccomp(config *configs.Seccomp) (int, error) {
}
}
// Enable libseccomp binary tree optimization for longer rulesets.
//
// The number below chosen semi-arbitrarily, considering the following:
// 1. libseccomp <= 2.5.4 misbehaves when binary tree optimization
// is enabled and there are 0 rules.
// 2. All known libseccomp versions (2.5.0 to 2.5.4) generate a binary
// tree with 4 syscalls per node.
if len(config.Syscalls) > 32 {
if err := filter.SetOptimize(2); err != nil {
// The error is not fatal and is probably means we have older libseccomp.
logrus.Debugf("seccomp binary tree optimization not available: %v", err)
}
}
// Unset no new privs bit
if err := filter.SetNoNewPrivsBit(false); err != nil {
return -1, fmt.Errorf("error setting no new privileges: %w", err)