Skip to content

db: reject conflicting seccomp rule actions - #506

Open
sairex53 wants to merge 1 commit into
seccomp:mainfrom
sairex53:fix-rule-action-conflicts-499
Open

sairex53 wants to merge 1 commit into
seccomp:mainfrom
sairex53:fix-rule-action-conflicts-499

Conversation

@sairex53

Copy link
Copy Markdown

Summary

  • Return -EEXIST when an unconditional rule would silently replace or discard rules for the same syscall with different actions.
  • Preserve same-action rule simplification.
  • Add regression coverage for both insertion orders and document the conflict behavior.

Fixes #499.

Testing

  • make -j4
  • cd tests && ./regression -b 11-basic-basic_errors -s 1 -m c -T basic
  • python3 -m py_compile tests/11-basic-basic_errors.py
  • ARM64 reproducer linked against the built static library: both conflicting rule orders return -EEXIST.

Return -EEXIST instead of silently discarding rules when an unconditional rule conflicts with a rule for the same syscall. Preserve the existing same-action rule simplification and cover both insertion orders in the regression tests.

Signed-off-by: Eduard Zateev <hackerowskiy@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Q: seccomp_rule_add() with conflicting rules keeps one rule and returns 0

1 participant