lxc-start: remove unnecessary checks

[mirror_lxc.git] / src / lxc / seccomp.c

diff --git a/src/lxc/seccomp.c b/src/lxc/seccomp.c
index 9369c90bf9e74efcf633fcf476f112af5acbb6ea..deacd12173cb5e3ccfe58d4de042fa90d7118856 100644 (file)
--- a/src/lxc/seccomp.c
+++ b/src/lxc/seccomp.c
@@ -75,7 +75,7 @@ static uint32_t get_v2_default_action(char *line)
 
        while (*line == ' ')
                line++;
-       // after 'whitelist' or 'blacklist' comes default behavior
+       /* After 'whitelist' or 'blacklist' comes default behavior. */
        if (strncmp(line, "kill", 4) == 0)
                ret_action = SCMP_ACT_KILL;
        else if (strncmp(line, "errno", 5) == 0) {
@@ -94,7 +94,7 @@ static uint32_t get_v2_default_action(char *line)
 
 static const char *get_action_name(uint32_t action)
 {
-       // The upper 16 bits indicate the type of the seccomp action
+       /* The upper 16 bits indicate the type of the seccomp action. */
        switch(action & 0xffff0000){
        case SCMP_ACT_KILL:
                return "kill";
@@ -170,7 +170,7 @@ int get_hostarch(void)
        }
        if (strcmp(uts.machine, "i686") == 0)
                return lxc_seccomp_arch_i386;
-       // no x32 kernels
+       /* no x32 kernels */
        else if (strcmp(uts.machine, "x86_64") == 0)
                return lxc_seccomp_arch_amd64;
        else if (strncmp(uts.machine, "armv7", 5) == 0)
@@ -434,7 +434,7 @@ static int parse_config_v2(FILE *f, char *line, struct lxc_conf *conf)
                remove_trailing_newlines(line);
                INFO("processing: .%s.", line);
                if (line[0] == '[') {
-                       // read the architecture for next set of rules
+                       /* Read the architecture for next set of rules. */
                        if (strcmp(line, "[x86]") == 0 ||
                            strcmp(line, "[X86]") == 0) {
                                if (native_arch != lxc_seccomp_arch_i386 &&
@@ -791,6 +791,18 @@ int lxc_seccomp_load(struct lxc_conf *conf)
                ERROR("Error loading the seccomp policy: %s.", strerror(-ret));
                return -1;
        }
+
+/* After load seccomp filter into the kernel successfully, export the current seccomp
+ * filter to log file */
+#if HAVE_SCMP_FILTER_CTX
+       if ((lxc_log_get_level() <= LXC_LOG_LEVEL_TRACE || conf->loglevel <= LXC_LOG_LEVEL_TRACE) &&
+           lxc_log_fd >= 0) {
+               ret = seccomp_export_pfc(conf->seccomp_ctx, lxc_log_fd);
+               /* Just give an warning when export error */
+               if (ret < 0)
+                       WARN("Failed to export seccomp filter to log file: %s.", strerror(-ret));
+       }
+#endif
        return 0;
 }