From 50524bd8879072ee41e539de768d4ab4a2792060 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Fri, 24 Mar 2023 11:17:08 +0100 Subject: [PATCH] seccomp-util: enforce group ordering So far we asked via a comment that @default should stay the first group and @known the last group in the list. Let's enforce that statically, in code, too. --- src/shared/seccomp-util.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/shared/seccomp-util.h b/src/shared/seccomp-util.h index 4f5b0249ad..5fd135d597 100644 --- a/src/shared/seccomp-util.h +++ b/src/shared/seccomp-util.h @@ -57,9 +57,12 @@ enum { SYSCALL_FILTER_SET_SYSTEM_SERVICE, SYSCALL_FILTER_SET_TIMER, SYSCALL_FILTER_SET_KNOWN, - _SYSCALL_FILTER_SET_MAX + _SYSCALL_FILTER_SET_MAX, }; +assert_cc(SYSCALL_FILTER_SET_DEFAULT == 0); +assert_cc(SYSCALL_FILTER_SET_KNOWN == _SYSCALL_FILTER_SET_MAX-1); + extern const SyscallFilterSet syscall_filter_sets[]; const SyscallFilterSet *syscall_filter_set_find(const char *name);