minijail: Check for repeat syscall definitions
Add an option that allows for checking for duplicate syscall
definitions.
Add as a compile-time option and filter_option. If this option is on:
Maintain a data structure throughout seccomp policy syscall filter
parsing that keeps track of syscalls that have already been encountered
and where they were defined. Use this structure to tell when there are
duplicate syscall policy definitions and warn the user.
Write a unit test that checks that compile_file will return -1 if there
is a repeat syscall policy definition. Also change existing tests to
reflect this behavior.
Bug: None
TEST=built and ran unit tests
Change-Id: I3f5da9f926006dc7498d4a6510dda5aa5aedd1a3
diff --git a/Makefile b/Makefile
index a7c4357..ce240a7 100644
--- a/Makefile
+++ b/Makefile
@@ -37,6 +37,11 @@
CPPFLAGS += -DUSE_EXIT_ON_DIE
endif
+# Setting this flag allows duplicate syscalls definitions for seccomp filters.
+ifeq ($(ALLOW_DUPLICATE_SYSCALLS),yes)
+CPPFLAGS += -DALLOW_DUPLICATE_SYSCALLS
+endif
+
MJ_COMMON_FLAGS = -Wunused-parameter -Wextra -Wno-missing-field-initializers
CFLAGS += $(MJ_COMMON_FLAGS)
CXXFLAGS += $(MJ_COMMON_FLAGS)