fn validate(&self) -> Result<()> {
        for (syscall_number, syscall_rules) in self.rules.iter() {
            // All inserted syscalls must have at least one rule, otherwise BPF code will break.
            if syscall_rules.is_empty() {
                return Err(Error::EmptyRulesVector);
            }

            // Now check for conflicting rules.
            // Match on the number of empty rules for the given syscall.
            // An `empty rule` is a rule that doesn't have any argument checks.
            match syscall_rules
                .iter()
                .filter(|rule| rule.conditions.is_empty())
                .count()
            {
                // If the syscall has an empty rule, it may only have that rule.
                1 if syscall_rules.len() > 1 => {
                    return Err(Error::ConflictingRules(*syscall_number));
                }
                // This syscall only has the one rule, so is valid.
                1 if syscall_rules.len() <= 1 => {}
                // The syscall has no empty rules.
                0 => {}
                // For a greater than 1 number of empty rules, error out.
                _ => {
                    return Err(Error::ConflictingRules(*syscall_number));
                }
            }
        }

        Ok(())
    }
/// Performs semantic checks on the SeccompFilter.
Performs semantic checks on the SeccompFilter.
Performs semantic checks on the SeccompFilter .
fn validate(&self) -> Result<()> {
        for (syscall_number, syscall_rules) in self.rules.iter() {
            // All inserted syscalls must have at least one rule, otherwise BPF code will break.
            if syscall_rules.is_empty() {
                return Err(Error::EmptyRulesVector);
            }
            // Now check for conflicting rules.
            // Match on the number of empty rules for the given syscall.
            // An `empty rule` is a rule that doesn't have any argument checks.
            match syscall_rules
                .iter()
                .filter(|rule| rule.conditions.is_empty())
                .count()
            {
                // If the syscall has an empty rule, it may only have that rule.
                1 if syscall_rules.len() > 1 => {
                    return Err(Error::ConflictingRules(*syscall_number));
                }
                // This syscall only has the one rule, so is valid.
                1 if syscall_rules.len() <= 1 => {}
                // The syscall has no empty rules.
                0 => {}
                // For a greater than 1 number of empty rules, error out.
                _ => {
                    return Err(Error::ConflictingRules(*syscall_number));
                }
            }
        }
        Ok(())
    }
fn validate ( & self ) -> Result < ( ) > { for ( syscall_number , syscall_rules ) in self . rules . iter ( ) { // All inserted syscalls must have at least one rule, otherwise BPF code will break. if syscall_rules . is_empty ( ) { return Err ( Error :: EmptyRulesVector ) ; } // Now check for conflicting rules. // Match on the number of empty rules for the given syscall. // An `empty rule` is a rule that doesn't have any argument checks. match syscall_rules . iter ( ) . filter ( | rule | rule . conditions . is_empty ( ) ) . count ( ) { // If the syscall has an empty rule, it may only have that rule. 1 if syscall_rules . len ( ) > 1 => { return Err ( Error :: ConflictingRules ( * syscall_number ) ) ; } // This syscall only has the one rule, so is valid. 1 if syscall_rules . len ( ) <= 1 => { } // The syscall has no empty rules. 0 => { } // For a greater than 1 number of empty rules, error out. _ => { return Err ( Error :: ConflictingRules ( * syscall_number ) ) ; } } } Ok ( ( ) ) }
Performs semantic checks on the SeccompFilter.
Performs semantic checks on the SeccompFilter .
&self
&self