fn append_syscall_chain(
        syscall_number: i64,
        chain: Vec<SeccompRule>,
        default_action: u32,
        accumulator: &mut Vec<Vec<sock_filter>>,
        filter_len: &mut usize,
    ) -> Result<()> {
        // The rules of the chain are translated into BPF statements.
        let chain: Vec<_> = chain.into_iter().map(SeccompRule::into).collect();
        let chain_len: usize = chain.iter().map(std::vec::Vec::len).sum();

        // The chain starts with a comparison checking the loaded syscall number against the
        // syscall number of the chain.
        let mut built_syscall = Vec::with_capacity(1 + chain_len + 1);
        built_syscall.push(BPF_JUMP(
            BPF_JMP + BPF_JEQ + BPF_K,
            syscall_number as u32,
            0,
            1,
        ));

        // The rules of the chain are appended.
        chain
            .into_iter()
            .for_each(|mut rule| built_syscall.append(&mut rule));

        // The default action is appended, if the syscall number comparison matched and then all
        // rules fail to match, the default action is reached.
        built_syscall.push(BPF_STMT(BPF_RET + BPF_K, default_action));

        // The chain is appended to the result.
        *filter_len += built_syscall.len();
        accumulator.push(built_syscall);

        // BPF programs are limited to 4096 statements.
        if *filter_len >= BPF_MAX_LEN {
            return Err(Error::FilterTooLarge);
        }

        Ok(())
    }
/// Appends a chain of rules to an accumulator, updating the length of the filter.
///
/// # Arguments
///
/// * `syscall_number` - The syscall to which the rules apply.
/// * `chain` - The chain of rules for the specified syscall.
/// * `default_action` - The action to be taken in none of the rules apply.
/// * `accumulator` - The expanding BPF program.
/// * `filter_len` - The size (in number of BPF statements) of the BPF program. This is
///                  limited to 4096. If the limit is exceeded, the filter is invalidated.
Appends a chain of rules to an accumulator, updating the length of the filter.
Appends a chain of rules to an accumulator updating the length of the filter .
fn append_syscall_chain(
        syscall_number: i64,
        chain: Vec<SeccompRule>,
        default_action: u32,
        accumulator: &mut Vec<Vec<sock_filter>>,
        filter_len: &mut usize,
    ) -> Result<()> {
        // The rules of the chain are translated into BPF statements.
        let chain: Vec<_> = chain.into_iter().map(SeccompRule::into).collect();
        let chain_len: usize = chain.iter().map(std::vec::Vec::len).sum();
        // The chain starts with a comparison checking the loaded syscall number against the
        // syscall number of the chain.
        let mut built_syscall = Vec::with_capacity(1 + chain_len + 1);
        built_syscall.push(BPF_JUMP(
            BPF_JMP + BPF_JEQ + BPF_K,
            syscall_number as u32,
            0,
            1,
        ));
        // The rules of the chain are appended.
        chain
            .into_iter()
            .for_each(|mut rule| built_syscall.append(&mut rule));
        // The default action is appended, if the syscall number comparison matched and then all
        // rules fail to match, the default action is reached.
        built_syscall.push(BPF_STMT(BPF_RET + BPF_K, default_action));
        // The chain is appended to the result.
        *filter_len += built_syscall.len();
        accumulator.push(built_syscall);
        // BPF programs are limited to 4096 statements.
        if *filter_len >= BPF_MAX_LEN {
            return Err(Error::FilterTooLarge);
        }
        Ok(())
    }
fn append_syscall_chain ( syscall_number : i64 , chain : Vec < SeccompRule > , default_action : u32 , accumulator : & mut Vec < Vec < sock_filter > > , filter_len : & mut usize , ) -> Result < ( ) > { // The rules of the chain are translated into BPF statements. let chain : Vec < _ > = chain . into_iter ( ) . map ( SeccompRule :: into ) . collect ( ) ; let chain_len : usize = chain . iter ( ) . map ( std :: vec :: Vec :: len ) . sum ( ) ; // The chain starts with a comparison checking the loaded syscall number against the // syscall number of the chain. let mut built_syscall = Vec :: with_capacity ( 1 + chain_len + 1 ) ; built_syscall . push ( BPF_JUMP ( BPF_JMP + BPF_JEQ + BPF_K , syscall_number as u32 , 0 , 1 , ) ) ; // The rules of the chain are appended. chain . into_iter ( ) . for_each ( | mut rule | built_syscall . append ( & mut rule ) ) ; // The default action is appended, if the syscall number comparison matched and then all // rules fail to match, the default action is reached. built_syscall . push ( BPF_STMT ( BPF_RET + BPF_K , default_action ) ) ; // The chain is appended to the result. * filter_len += built_syscall . len ( ) ; accumulator . push ( built_syscall ) ; // BPF programs are limited to 4096 statements. if * filter_len >= BPF_MAX_LEN { return Err ( Error :: FilterTooLarge ) ; } Ok ( ( ) ) }
Appends a chain of rules to an accumulator, updating the length of the filter.
Appends a chain of rules to an accumulator updating the length of the filter .
syscall_number
i64
chain
Vec<SeccompRule>
default_action
u32
accumulator
&mut Vec<Vec<sock_filter>>
filter_len
&mut usize
syscall_number
i64
chain
Vec<SeccompRule>
default_action
u32
accumulator
&mut Vec<Vec<sock_filter>>
filter_len
&mut usize