diff --git a/src/nspawn/nspawn-seccomp.c b/src/nspawn/nspawn-seccomp.c index 34a8627848..fa05a8a5b4 100644 --- a/src/nspawn/nspawn-seccomp.c +++ b/src/nspawn/nspawn-seccomp.c @@ -169,7 +169,7 @@ static int add_syscall_filters( /* We have a large filter here, so let's turn on the binary tree mode if possible. */ r = seccomp_attr_set(ctx, SCMP_FLTATR_CTL_OPTIMIZE, 2); if (r < 0) - return r; + log_warning_errno(r, "Failed to set SCMP_FLTATR_CTL_OPTIMIZE, ignoring: %m"); #endif return 0; diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c index d85275dbc6..cd30e72ad5 100644 --- a/src/shared/seccomp-util.c +++ b/src/shared/seccomp-util.c @@ -1183,6 +1183,13 @@ int seccomp_load_syscall_filter_set_raw(uint32_t default_action, Hashmap* filter name, id); } +#if (SCMP_VER_MAJOR == 2 && SCMP_VER_MINOR >= 5) || SCMP_VER_MAJOR > 2 + /* We have a large filter here, so let's turn on the binary tree mode if possible. */ + r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_OPTIMIZE, 2); + if (r < 0) + log_warning_errno(r, "Failed to set SCMP_FLTATR_CTL_OPTIMIZE, ignoring: %m"); +#endif + r = seccomp_load(seccomp); if (ERRNO_IS_NEG_SECCOMP_FATAL(r)) return r;