Merge "Optimize seccomp" am: 7e812616c9 am: 9375f3eff6
am: 38b7d83f8e
Change-Id: Ia48dba402b42dcd449507ea34a438e2a14d4164f
diff --git a/core/jni/android_os_seccomp.cpp b/core/jni/android_os_seccomp.cpp
index fc35a74..75b898e 100644
--- a/core/jni/android_os_seccomp.cpp
+++ b/core/jni/android_os_seccomp.cpp
@@ -122,6 +122,10 @@
// 64-bit filter
ExamineSyscall(f);
+ // arm64-only filter - autogenerated from bionic syscall usage
+ for (size_t i = 0; i < arm64_filter_size; ++i)
+ f.push_back(arm64_filter[i]);
+
// Syscalls needed to boot Android
AllowSyscall(f, 41); // __NR_pivot_root
AllowSyscall(f, 31); // __NR_ioprio_get
@@ -143,9 +147,7 @@
// Needed for kernel to restart syscalls
AllowSyscall(f, 128); // __NR_restart_syscall
- // arm64-only filter - autogenerated from bionic syscall usage
- for (size_t i = 0; i < arm64_filter_size; ++i)
- f.push_back(arm64_filter[i]);
+ Trap(f);
if (SetValidateArchitectureJumpTarget(offset_to_32bit_filter, f) != 0)
return -1;
@@ -153,6 +155,10 @@
// 32-bit filter
ExamineSyscall(f);
+ // arm32 filter - autogenerated from bionic syscall usage
+ for (size_t i = 0; i < arm_filter_size; ++i)
+ f.push_back(arm_filter[i]);
+
// Syscalls needed to boot android
AllowSyscall(f, 120); // __NR_clone
AllowSyscall(f, 240); // __NR_futex
@@ -200,9 +206,7 @@
// already allowed.
AllowSyscall(f, 85); // __NR_readlink
- // arm32 filter - autogenerated from bionic syscall usage
- for (size_t i = 0; i < arm_filter_size; ++i)
- f.push_back(arm_filter[i]);
+ Trap(f);
return install_filter(f);
}