0

Should I release the filter also after seccomp_load() is called? Or only if some of the calls to seccomp_rule_add() fails?

For example

OPTION1

r = seccomp_rule_add(...)
if r < 0 seccomp_relase(...)
r =seccomp_rule_add(...)
if r < 0 seccomp_relase(...)

seccomp_load(...)

OPTION2

r = seccomp_rule_add(...)
if r < 0 seccomp_relase(...)
r =seccomp_rule_add(...)
if r < 0 seccomp_relase(...)

seccomp_load(...)
seccomp_release(...)
Maicake
  • 1,046
  • 10
  • 34

1 Answers1

1

Should I release the filter also after seccomp_load() is called?

Yes, you should always release that state once you're finished with it. See the seccomp_load manpage for an example code. Filters loaded in the kernel will remain active.

pchaigno
  • 11,313
  • 2
  • 29
  • 54
  • with always you mean "always when some call return error ?" – Maicake Aug 11 '19 at 13:02
  • I mean always, whatever error is encountered and even if there are no errors. – pchaigno Aug 11 '19 at 13:06
  • because in the example you linked it's called just if there is an error right? . Also here https://www.paul-moore.com/docs/devconf-syscall_filtering-pmoore-012014-r1.pdf it's called just if there is an error. But I though I had to call it also after a successful call to seccomp_load – Maicake Aug 11 '19 at 13:17
  • No, if there are no errors, execution goes through the `out` label anyway. It's a common coding pattern in C. It might be clearer with the following, even though there's no call to seccomp_load: http://man7.org/linux/man-pages/man3/seccomp_release.3.html. – pchaigno Aug 11 '19 at 13:25
  • And in the PDF you linked, on slide 9, it also goes through out if there are no errors. – pchaigno Aug 11 '19 at 13:43
  • so also without explictly call goto out it pass thorugh the label? In the slide 9 how can the code reach seccomp_release if it arrives to seccomp_load without executing goto out? – Maicake Aug 11 '19 at 13:52
  • 1
    Yes it does. A label only marks a point of the program and goto are a shortcut (i.e., a jump) to that label. The code after a label can be executed without executing any goto statement. – pchaigno Aug 11 '19 at 16:03