script_core 0.2.3 → 0.3.0

data/ext/enterprise_script_service/libseccomp/src/arch-x32.c

@@ -26,14 +26,48 @@
 #include "arch.h"
 #include "arch-x32.h"
 
+/**
+ * Resolve a syscall name to a number
+ * @param name the syscall name
+ *
+ * Resolve the given syscall name to the syscall number using the syscall table.
+ * Returns the syscall number on success, including negative pseudo syscall
+ * numbers; returns __NR_SCMP_ERROR on failure.
+ *
+ */
+int x32_syscall_resolve_name_munge(const char *name)
+{
+	int sys;
+
+	sys = x32_syscall_resolve_name(name);
+	if (sys == __NR_SCMP_ERROR)
+		return sys;
+
+	return (sys | X32_SYSCALL_BIT);
+}
+
+/**
+ * Resolve a syscall number to a name
+ * @param num the syscall number
+ *
+ * Resolve the given syscall number to the syscall name using the syscall table.
+ * Returns a pointer to the syscall name string on success, including pseudo
+ * syscall names; returns NULL on failure.
+ *
+ */
+const char *x32_syscall_resolve_num_munge(int num)
+{
+	return x32_syscall_resolve_num(num & (~X32_SYSCALL_BIT));
+}
+
 const struct arch_def arch_def_x32 = {
 	.token = SCMP_ARCH_X32,
 	/* NOTE: this seems odd but the kernel treats x32 like x86_64 here */
 	.token_bpf = AUDIT_ARCH_X86_64,
 	.size = ARCH_SIZE_32,
 	.endian = ARCH_ENDIAN_LITTLE,
-	.syscall_resolve_name = x32_syscall_resolve_name,
-	.syscall_resolve_num = x32_syscall_resolve_num,
+	.syscall_resolve_name = x32_syscall_resolve_name_munge,
+	.syscall_resolve_num = x32_syscall_resolve_num_munge,
 	.syscall_rewrite = NULL,
 	.rule_add = NULL,
 };

data/ext/enterprise_script_service/libseccomp/src/arch-x32.h

@@ -22,18 +22,10 @@
 #ifndef _ARCH_X32_H
 #define _ARCH_X32_H
 
-#include <inttypes.h>
-
 #include "arch.h"
-#include "system.h"
-
-#define X32_SYSCALL_BIT			0x40000000
-
-extern const struct arch_def arch_def_x32;
 
-int x32_syscall_resolve_name(const char *name);
-const char *x32_syscall_resolve_num(int num);
+#define X32_SYSCALL_BIT                 0x40000000
 
-const struct arch_syscall_def *x32_syscall_iterate(unsigned int spot);
+ARCH_DECL(x32)
 
 #endif

data/ext/enterprise_script_service/libseccomp/src/arch-x86.c

@@ -24,6 +24,8 @@
 #include <string.h>
 #include <linux/audit.h>
 
+#include "db.h"
+#include "syscalls.h"
 #include "arch.h"
 #include "arch-x86.h"
 
@@ -31,16 +33,165 @@
 #define __x86_NR_socketcall		102
 #define __x86_NR_ipc			117
 
-const struct arch_def arch_def_x86 = {
-	.token = SCMP_ARCH_X86,
-	.token_bpf = AUDIT_ARCH_I386,
-	.size = ARCH_SIZE_32,
-	.endian = ARCH_ENDIAN_LITTLE,
-	.syscall_resolve_name = x86_syscall_resolve_name,
-	.syscall_resolve_num = x86_syscall_resolve_num,
-	.syscall_rewrite = x86_syscall_rewrite,
-	.rule_add = x86_rule_add,
-};
+/**
+ * Resolve a syscall name to a number
+ * @param name the syscall name
+ *
+ * Resolve the given syscall name to the syscall number using the syscall table.
+ * Returns the syscall number on success, including negative pseudo syscall
+ * numbers; returns __NR_SCMP_ERROR on failure.
+ *
+ */
+int x86_syscall_resolve_name_munge(const char *name)
+{
+	if (strcmp(name, "accept") == 0)
+		return __PNR_accept;
+	else if (strcmp(name, "accept4") == 0)
+		return __PNR_accept4;
+	else if (strcmp(name, "bind") == 0)
+		return __PNR_bind;
+	else if (strcmp(name, "connect") == 0)
+		return __PNR_connect;
+	else if (strcmp(name, "getpeername") == 0)
+		return __PNR_getpeername;
+	else if (strcmp(name, "getsockname") == 0)
+		return __PNR_getsockname;
+	else if (strcmp(name, "getsockopt") == 0)
+		return __PNR_getsockopt;
+	else if (strcmp(name, "listen") == 0)
+		return __PNR_listen;
+	else if (strcmp(name, "recv") == 0)
+		return __PNR_recv;
+	else if (strcmp(name, "recvfrom") == 0)
+		return __PNR_recvfrom;
+	else if (strcmp(name, "recvmsg") == 0)
+		return __PNR_recvmsg;
+	else if (strcmp(name, "recvmmsg") == 0)
+		return __PNR_recvmmsg;
+	else if (strcmp(name, "send") == 0)
+		return __PNR_send;
+	else if (strcmp(name, "sendmsg") == 0)
+		return __PNR_sendmsg;
+	else if (strcmp(name, "sendmmsg") == 0)
+		return __PNR_sendmmsg;
+	else if (strcmp(name, "sendto") == 0)
+		return __PNR_sendto;
+	else if (strcmp(name, "setsockopt") == 0)
+		return __PNR_setsockopt;
+	else if (strcmp(name, "shutdown") == 0)
+		return __PNR_shutdown;
+	else if (strcmp(name, "socket") == 0)
+		return __PNR_socket;
+	else if (strcmp(name, "socketpair") == 0)
+		return __PNR_socketpair;
+
+	if (strcmp(name, "semop") == 0)
+		return __PNR_semop;
+	else if (strcmp(name, "semget") == 0)
+		return __PNR_semget;
+	else if (strcmp(name, "semctl") == 0)
+		return __PNR_semctl;
+	else if (strcmp(name, "semtimedop") == 0)
+		return __PNR_semtimedop;
+	else if (strcmp(name, "msgsnd") == 0)
+		return __PNR_msgsnd;
+	else if (strcmp(name, "msgrcv") == 0)
+		return __PNR_msgrcv;
+	else if (strcmp(name, "msgget") == 0)
+		return __PNR_msgget;
+	else if (strcmp(name, "msgctl") == 0)
+		return __PNR_msgctl;
+	else if (strcmp(name, "shmat") == 0)
+		return __PNR_shmat;
+	else if (strcmp(name, "shmdt") == 0)
+		return __PNR_shmdt;
+	else if (strcmp(name, "shmget") == 0)
+		return __PNR_shmget;
+	else if (strcmp(name, "shmctl") == 0)
+		return __PNR_shmctl;
+
+	return x86_syscall_resolve_name(name);
+}
+
+/**
+ * Resolve a syscall number to a name
+ * @param num the syscall number
+ *
+ * Resolve the given syscall number to the syscall name using the syscall table.
+ * Returns a pointer to the syscall name string on success, including pseudo
+ * syscall names; returns NULL on failure.
+ *
+ */
+const char *x86_syscall_resolve_num_munge(int num)
+{
+	if (num == __PNR_accept)
+		return "accept";
+	else if (num == __PNR_accept4)
+		return "accept4";
+	else if (num == __PNR_bind)
+		return "bind";
+	else if (num == __PNR_connect)
+		return "connect";
+	else if (num == __PNR_getpeername)
+		return "getpeername";
+	else if (num == __PNR_getsockname)
+		return "getsockname";
+	else if (num == __PNR_getsockopt)
+		return "getsockopt";
+	else if (num == __PNR_listen)
+		return "listen";
+	else if (num == __PNR_recv)
+		return "recv";
+	else if (num == __PNR_recvfrom)
+		return "recvfrom";
+	else if (num == __PNR_recvmsg)
+		return "recvmsg";
+	else if (num == __PNR_recvmmsg)
+		return "recvmmsg";
+	else if (num == __PNR_send)
+		return "send";
+	else if (num == __PNR_sendmsg)
+		return "sendmsg";
+	else if (num == __PNR_sendmmsg)
+		return "sendmmsg";
+	else if (num == __PNR_sendto)
+		return "sendto";
+	else if (num == __PNR_setsockopt)
+		return "setsockopt";
+	else if (num == __PNR_shutdown)
+		return "shutdown";
+	else if (num == __PNR_socket)
+		return "socket";
+	else if (num == __PNR_socketpair)
+		return "socketpair";
+
+	if (num == __PNR_semop)
+		return "semop";
+	else if (num == __PNR_semget)
+		return "semget";
+	else if (num == __PNR_semctl)
+		return "semctl";
+	else if (num == __PNR_semtimedop)
+		return "semtimedop";
+	else if (num == __PNR_msgsnd)
+		return "msgsnd";
+	else if (num == __PNR_msgrcv)
+		return "msgrcv";
+	else if (num == __PNR_msgget)
+		return "msgget";
+	else if (num == __PNR_msgctl)
+		return "msgctl";
+	else if (num == __PNR_shmat)
+		return "shmat";
+	else if (num == __PNR_shmdt)
+		return "shmdt";
+	else if (num == __PNR_shmget)
+		return "shmget";
+	else if (num == __PNR_shmctl)
+		return "shmctl";
+
+	return x86_syscall_resolve_num(num);
+}
 
 /**
  * Convert a multiplexed pseudo syscall into a direct syscall
@@ -461,3 +612,14 @@ add_return:
 		free(rule_dup);
 	return rc;
 }
+
+const struct arch_def arch_def_x86 = {
+	.token = SCMP_ARCH_X86,
+	.token_bpf = AUDIT_ARCH_I386,
+	.size = ARCH_SIZE_32,
+	.endian = ARCH_ENDIAN_LITTLE,
+	.syscall_resolve_name = x86_syscall_resolve_name_munge,
+	.syscall_resolve_num = x86_syscall_resolve_num_munge,
+	.syscall_rewrite = x86_syscall_rewrite,
+	.rule_add = x86_rule_add,
+};

data/ext/enterprise_script_service/libseccomp/src/arch-x86.h

@@ -22,21 +22,8 @@
 #ifndef _ARCH_X86_H
 #define _ARCH_X86_H
 
-#include <stdbool.h>
-
 #include "arch.h"
-#include "db.h"
-#include "system.h"
-
-extern const struct arch_def arch_def_x86;
-
-int x86_syscall_resolve_name(const char *name);
-const char *x86_syscall_resolve_num(int num);
-
-const struct arch_syscall_def *x86_syscall_iterate(unsigned int spot);
-
-int x86_syscall_rewrite(int *syscall);
 
-int x86_rule_add(struct db_filter *db, struct db_api_rule_list *rule);
+ARCH_DECL(x86)
 
 #endif

data/ext/enterprise_script_service/libseccomp/src/arch-x86_64.h

@@ -22,16 +22,8 @@
 #ifndef _ARCH_x86_64_H
 #define _ARCH_x86_64_H
 
-#include <inttypes.h>
-
 #include "arch.h"
-#include "system.h"
-
-extern const struct arch_def arch_def_x86_64;
-
-int x86_64_syscall_resolve_name(const char *name);
-const char *x86_64_syscall_resolve_num(int num);
 
-const struct arch_syscall_def *x86_64_syscall_iterate(unsigned int spot);
+ARCH_DECL(x86_64)
 
 #endif

data/ext/enterprise_script_service/libseccomp/src/arch.c

@@ -39,8 +39,10 @@
 #include "arch-mips64.h"
 #include "arch-mips64n32.h"
 #include "arch-parisc.h"
+#include "arch-parisc64.h"
 #include "arch-ppc.h"
 #include "arch-ppc64.h"
+#include "arch-riscv64.h"
 #include "arch-s390.h"
 #include "arch-s390x.h"
 #include "db.h"
@@ -94,6 +96,8 @@ const struct arch_def *arch_def_native = &arch_def_ppc;
 const struct arch_def *arch_def_native = &arch_def_s390x;
 #elif __s390__
 const struct arch_def *arch_def_native = &arch_def_s390;
+#elif __riscv && __riscv_xlen == 64
+const struct arch_def *arch_def_native = &arch_def_riscv64;
 #else
 #error the arch code needs to know about your machine type
 #endif /* machine type guess */
@@ -156,6 +160,8 @@ const struct arch_def *arch_def_lookup(uint32_t token)
 		return &arch_def_s390;
 	case SCMP_ARCH_S390X:
 		return &arch_def_s390x;
+	case SCMP_ARCH_RISCV64:
+		return &arch_def_riscv64;
 	}
 
 	return NULL;
@@ -206,6 +212,8 @@ const struct arch_def *arch_def_lookup_name(const char *arch_name)
 		return &arch_def_s390;
 	else if (strcmp(arch_name, "s390x") == 0)
 		return &arch_def_s390x;
+	else if (strcmp(arch_name, "riscv64") == 0)
+		return &arch_def_riscv64;
 
 	return NULL;
 }
@@ -367,10 +375,10 @@ int arch_syscall_rewrite(const struct arch_def *arch, int *syscall)
 	if (sys >= -1) {
 		/* we shouldn't be here - no rewrite needed */
 		return 0;
-	} else if (sys < -1 && sys > -100) {
-		/* reserved values */
+	} else if (sys > -100) {
+		/* -2 to -99 are reserved values */
 		return -EINVAL;
-	} else if (sys <= -100 && sys > -10000) {
+	} else if (sys > -10000) {
 		/* rewritable syscalls */
 		if (arch->syscall_rewrite)
 			(*arch->syscall_rewrite)(syscall);

data/ext/enterprise_script_service/libseccomp/src/arch.h

@@ -59,6 +59,13 @@ struct arch_def {
 /* arch_def for the current architecture */
 extern const struct arch_def *arch_def_native;
 
+/* macro to declare the arch specific structures and functions */
+#define ARCH_DECL(NAME) \
+	extern const struct arch_def arch_def_##NAME; \
+	int NAME##_syscall_resolve_name(const char *name); \
+	const char *NAME##_syscall_resolve_num(int num); \
+	const struct arch_syscall_def *NAME##_syscall_iterate(unsigned int spot);
+
 /* syscall name/num mapping */
 struct arch_syscall_def {
 	const char *name;

data/ext/enterprise_script_service/libseccomp/src/db.c

@@ -841,6 +841,7 @@ static void _db_reset(struct db_filter *db)
 		}
 		db->syscalls = NULL;
 	}
+	db->syscall_cnt = 0;
 
 	/* free any rules */
 	if (db->rules != NULL) {
@@ -909,6 +910,9 @@ static void _db_snap_release(struct db_filter_snap *snap)
 {
 	unsigned int iter;
 
+	if (snap == NULL)
+		return;
+
 	if (snap->filter_cnt > 0) {
 		for (iter = 0; iter < snap->filter_cnt; iter++) {
 			if (snap->filters[iter])
@@ -1053,6 +1057,7 @@ int db_col_reset(struct db_filter_col *col, uint32_t def_action)
 	if (col->filters)
 		free(col->filters);
 	col->filters = NULL;
+	col->notify_fd = -1;
 
 	/* set the endianess to undefined */
 	col->endian = 0;
@@ -1064,9 +1069,16 @@ int db_col_reset(struct db_filter_col *col, uint32_t def_action)
 	col->attr.tsync_enable = 0;
 	col->attr.api_tskip = 0;
 	col->attr.log_enable = 0;
+	col->attr.spec_allow = 0;
+	col->attr.optimize = 1;
+	col->attr.api_sysrawrc = 0;
 
 	/* set the state */
 	col->state = _DB_STA_VALID;
+	if (def_action == SCMP_ACT_NOTIFY)
+		col->notify_used = true;
+	else
+		col->notify_used = false;
 
 	/* reset the initial db */
 	db = _db_init(arch_def_native);
@@ -1128,6 +1140,7 @@ init_failure:
 void db_col_release(struct db_filter_col *col)
 {
 	unsigned int iter;
+	struct db_filter_snap *snap;
 
 	if (col == NULL)
 		return;
@@ -1135,6 +1148,13 @@ void db_col_release(struct db_filter_col *col)
 	/* set the state, just in case */
 	col->state = _DB_STA_FREED;
 
+	/* free any snapshots */
+	while (col->snapshots != NULL) {
+		snap = col->snapshots;
+		col->snapshots = snap->next;
+		_db_snap_release(snap);
+	}
+
 	/* free any filters */
 	for (iter = 0; iter < col->filter_cnt; iter++)
 		_db_release(col->filters[iter]);
@@ -1148,30 +1168,42 @@ void db_col_release(struct db_filter_col *col)
 }
 
 /**
- * Validate the seccomp action
- * @param action the seccomp action
+ * Validate a filter collection
+ * @param col the seccomp filter collection
+ *
+ * This function validates a seccomp filter collection.  Returns zero if the
+ * collection is valid, negative values on failure.
  *
- * Verify that the given action is a valid seccomp action; return zero if
- * valid, -EINVAL if invalid.
  */
-int db_action_valid(uint32_t action)
+int db_col_valid(struct db_filter_col *col)
 {
-	if (sys_chk_seccomp_action(action) == 1)
+	if (col != NULL && col->state == _DB_STA_VALID && col->filter_cnt > 0)
 		return 0;
 	return -EINVAL;
 }
 
 /**
- * Validate a filter collection
+ * Validate the seccomp action
  * @param col the seccomp filter collection
+ * @param action the seccomp action
  *
- * This function validates a seccomp filter collection.  Returns zero if the
- * collection is valid, negative values on failure.
- *
+ * Verify that the given action is a valid seccomp action; return zero if
+ * valid, -EINVAL if invalid.
  */
-int db_col_valid(struct db_filter_col *col)
+int db_col_action_valid(const struct db_filter_col *col, uint32_t action)
 {
-	if (col != NULL && col->state == _DB_STA_VALID && col->filter_cnt > 0)
+	if (col != NULL) {
+		/* NOTE: in some cases we don't have a filter collection yet,
+		 *       but when we do we need to do the following checks */
+
+		/* kernel disallows TSYNC and NOTIFY in one filter unless we
+		 * have the TSYNC_ESRCH flag */
+		if (sys_chk_seccomp_flag(SECCOMP_FILTER_FLAG_TSYNC_ESRCH) < 1 &&
+		    col->attr.tsync_enable && action == SCMP_ACT_NOTIFY)
+			return -EINVAL;
+	}
+
+	if (sys_chk_seccomp_action(action) == 1)
 		return 0;
 	return -EINVAL;
 }
@@ -1281,14 +1313,42 @@ int db_col_attr_get(const struct db_filter_col *col,
 	case SCMP_FLTATR_CTL_LOG:
 		*value = col->attr.log_enable;
 		break;
+	case SCMP_FLTATR_CTL_SSB:
+		*value = col->attr.spec_allow;
+		break;
+	case SCMP_FLTATR_CTL_OPTIMIZE:
+		*value = col->attr.optimize;
+		break;
+	case SCMP_FLTATR_API_SYSRAWRC:
+		*value = col->attr.api_sysrawrc;
+		break;
 	default:
-		rc = -EEXIST;
+		rc = -EINVAL;
 		break;
 	}
 
 	return rc;
 }
 
+/**
+ * Get a filter attribute
+ * @param col the seccomp filter collection
+ * @param attr the filter attribute
+ *
+ * Returns the requested filter attribute value with zero on any error.
+ * Special care must be given with this function as error conditions can be
+ * hidden from the caller.
+ *
+ */
+uint32_t db_col_attr_read(const struct db_filter_col *col,
+			  enum scmp_filter_attr attr)
+{
+	uint32_t value = 0;
+
+	db_col_attr_get(col, attr, &value);
+	return value;
+}
+
 /**
  * Set a filter attribute
  * @param col the seccomp filter collection
@@ -1310,7 +1370,7 @@ int db_col_attr_set(struct db_filter_col *col,
 		return -EACCES;
 		break;
 	case SCMP_FLTATR_ACT_BADARCH:
-		if (db_action_valid(value) == 0)
+		if (db_col_action_valid(col, value) == 0)
 			col->attr.act_badarch = value;
 		else
 			return -EINVAL;
@@ -1323,6 +1383,11 @@ int db_col_attr_set(struct db_filter_col *col,
 		if (rc == 1) {
 			/* supported */
 			rc = 0;
+			/* kernel disallows TSYNC and NOTIFY in one filter
+			 * unless we have TSYNC_ESRCH */
+			if (sys_chk_seccomp_flag(SECCOMP_FILTER_FLAG_TSYNC_ESRCH) < 1 &&
+			    value && col->notify_used)
+				return -EINVAL;
 			col->attr.tsync_enable = (value ? 1 : 0);
 		} else if (rc == 0)
 			/* unsupported */
@@ -1342,8 +1407,33 @@ int db_col_attr_set(struct db_filter_col *col,
 			rc = -EOPNOTSUPP;
 		}
 		break;
+	case SCMP_FLTATR_CTL_SSB:
+		rc = sys_chk_seccomp_flag(SECCOMP_FILTER_FLAG_SPEC_ALLOW);
+		if (rc == 1) {
+			/* supported */
+			rc = 0;
+			col->attr.spec_allow = (value ? 1 : 0);
+		} else if (rc == 0) {
+			/* unsupported */
+			rc = -EOPNOTSUPP;
+		}
+		break;
+	case SCMP_FLTATR_CTL_OPTIMIZE:
+		switch (value) {
+		case 1:
+		case 2:
+			col->attr.optimize = value;
+			break;
+		default:
+			rc = -EOPNOTSUPP;
+			break;
+		}
+		break;
+	case SCMP_FLTATR_API_SYSRAWRC:
+		col->attr.api_sysrawrc = (value ? 1 : 0);
+		break;
 	default:
-		rc = -EEXIST;
+		rc = -EINVAL;
 		break;
 	}
 
@@ -2008,6 +2098,7 @@ add_reset:
 			s_new->next = db->syscalls;
 			db->syscalls = s_new;
 		}
+		db->syscall_cnt++;
 		return 0;
 	} else if (s_iter->chains == NULL) {
 		if (rm_flag || !s_iter->valid) {
@@ -2146,6 +2237,44 @@ priority_failure:
 	return rc;
 }
 
+/**
+ * Add a new rule to a single filter
+ * @param filter the filter
+ * @param rule the filter rule
+ *
+ * This is a helper function for db_col_rule_add() and similar functions, it
+ * isn't generally useful.  Returns zero on success, negative values on error.
+ *
+ */
+static int _db_col_rule_add(struct db_filter *filter,
+			    struct db_api_rule_list *rule)
+{
+	int rc;
+	struct db_api_rule_list *iter;
+
+	/* add the rule to the filter */
+	rc = arch_filter_rule_add(filter, rule);
+	if (rc != 0)
+		return rc;
+
+	/* insert the chain to the end of the rule list */
+	iter = rule;
+	while (iter->next)
+		iter = iter->next;
+	if (filter->rules != NULL) {
+		rule->prev = filter->rules->prev;
+		iter->next = filter->rules;
+		filter->rules->prev->next = rule;
+		filter->rules->prev = iter;
+	} else {
+		rule->prev = iter;
+		iter->next = rule;
+		filter->rules = rule;
+	}
+
+	return 0;
+}
+
 /**
  * Add a new rule to the current filter
  * @param col the filter collection
@@ -2174,7 +2303,7 @@ int db_col_rule_add(struct db_filter_col *col,
 	size_t chain_size;
 	struct db_api_arg *chain = NULL;
 	struct scmp_arg_cmp arg_data;
-	struct db_api_rule_list *rule, *rule_tmp;
+	struct db_api_rule_list *rule;
 	struct db_filter *db;
 
 	/* collect the arguments for the filter rule */
@@ -2222,9 +2351,6 @@ int db_col_rule_add(struct db_filter_col *col,
 
 	/* add the rule to the different filters in the collection */
 	for (iter = 0; iter < col->filter_cnt; iter++) {
-
-		/* TODO: consolidate with db_col_transaction_start() */
-
 		db = col->filters[iter];
 
 		/* create the rule */
@@ -2235,24 +2361,10 @@ int db_col_rule_add(struct db_filter_col *col,
 		}
 
 		/* add the rule */
-		rc_tmp = arch_filter_rule_add(db, rule);
-		if (rc_tmp == 0) {
-			/* insert the chain to the end of the rule list */
-			rule_tmp = rule;
-			while (rule_tmp->next)
-				rule_tmp = rule_tmp->next;
-			if (db->rules != NULL) {
-				rule->prev = db->rules->prev;
-				rule_tmp->next = db->rules;
-				db->rules->prev->next = rule;
-				db->rules->prev = rule_tmp;
-			} else {
-				rule->prev = rule_tmp;
-				rule_tmp->next = rule;
-				db->rules = rule;
-			}
-		} else
+		rc_tmp = _db_col_rule_add(db, rule);
+		if (rc_tmp != 0)
 			free(rule);
+
 add_arch_fail:
 		if (rc_tmp != 0 && rc == 0)
 			rc = rc_tmp;
@@ -2265,6 +2377,9 @@ add_arch_fail:
 		db_col_transaction_abort(col);
 
 add_return:
+	/* update the misc state */
+	if (rc == 0 && action == SCMP_ACT_NOTIFY)
+		col->notify_used = true;
 	if (chain != NULL)
 		free(chain);
 	return rc;
@@ -2284,7 +2399,21 @@ int db_col_transaction_start(struct db_filter_col *col)
 	unsigned int iter;
 	struct db_filter_snap *snap;
 	struct db_filter *filter_o, *filter_s;
-	struct db_api_rule_list *rule_o, *rule_s = NULL, *rule_tmp;
+	struct db_api_rule_list *rule_o, *rule_s = NULL;
+
+	/* check to see if a shadow snapshot exists */
+	if (col->snapshots && col->snapshots->shadow) {
+		/* we have a shadow!  this will be easy */
+
+		/* NOTE: we don't bother to do any verification of the shadow
+		 *       because we start a new transaction every time we add
+		 *       a new rule to the filter(s); if this ever changes we
+		 *       will need to add a mechanism to verify that the shadow
+		 *       transaction is current/correct */
+
+		col->snapshots->shadow = false;
+		return 0;
+	}
 
 	/* allocate the snapshot */
 	snap = zmalloc(sizeof(*snap));
@@ -2314,33 +2443,15 @@ int db_col_transaction_start(struct db_filter_col *col)
 		if (rule_o == NULL)
 			continue;
 		do {
-
-			/* TODO: consolidate with db_col_rule_add() */
-
 			/* duplicate the rule */
 			rule_s = db_rule_dup(rule_o);
 			if (rule_s == NULL)
 				goto trans_start_failure;
 
 			/* add the rule */
-			rc = arch_filter_rule_add(filter_s, rule_s);
+			rc = _db_col_rule_add(filter_s, rule_s);
 			if (rc != 0)
 				goto trans_start_failure;
-
-			/* insert the chain to the end of the rule list */
-			rule_tmp = rule_s;
-			while (rule_tmp->next)
-				rule_tmp = rule_tmp->next;
-			if (filter_s->rules != NULL) {
-				rule_s->prev = filter_s->rules->prev;
-				rule_tmp->next = filter_s->rules;
-				filter_s->rules->prev->next = rule_s;
-				filter_s->rules->prev = rule_tmp;
-			} else {
-				rule_s->prev = rule_tmp;
-				rule_tmp->next = rule_s;
-				filter_s->rules = rule_s;
-			}
 			rule_s = NULL;
 
 			/* next rule */
@@ -2397,14 +2508,114 @@ void db_col_transaction_abort(struct db_filter_col *col)
  * Commit the top most seccomp filter transaction
  * @param col the filter collection
  *
- * This function commits the most recent seccomp filter transaction.
+ * This function commits the most recent seccomp filter transaction and
+ * attempts to create a shadow transaction that is a duplicate of the current
+ * filter to speed up future transactions.
  *
  */
 void db_col_transaction_commit(struct db_filter_col *col)
 {
+	int rc;
+	unsigned int iter;
 	struct db_filter_snap *snap;
+	struct db_filter *filter_o, *filter_s;
+	struct db_api_rule_list *rule_o, *rule_s;
 
 	snap = col->snapshots;
+	if (snap == NULL)
+		return;
+
+	/* check for a shadow set by a higher transaction commit */
+	if (snap->shadow) {
+		/* leave the shadow intact, but drop the next snapshot */
+		if (snap->next) {
+			snap->next = snap->next->next;
+			_db_snap_release(snap->next);
+		}
+		return;
+	}
+
+	/* adjust the number of filters if needed */
+	if (col->filter_cnt > snap->filter_cnt) {
+		unsigned int tmp_i;
+		struct db_filter **tmp_f;
+
+		/* add filters */
+		tmp_f = realloc(snap->filters,
+				sizeof(struct db_filter *) * col->filter_cnt);
+		if (tmp_f == NULL)
+			goto shadow_err;
+		snap->filters = tmp_f;
+		do {
+			tmp_i = snap->filter_cnt;
+			snap->filters[tmp_i] =
+				_db_init(col->filters[tmp_i]->arch);
+			if (snap->filters[tmp_i] == NULL)
+				goto shadow_err;
+			snap->filter_cnt++;
+		} while (snap->filter_cnt < col->filter_cnt);
+	} else if (col->filter_cnt < snap->filter_cnt) {
+		/* remove filters */
+
+		/* NOTE: while we release the filters we no longer need, we
+		 *       don't bother to resize the filter array, we just
+		 *       adjust the filter counter, this *should* be harmless
+		 *       at the cost of a not reaping all the memory possible */
+
+		do {
+			_db_release(snap->filters[snap->filter_cnt--]);
+		} while (snap->filter_cnt > col->filter_cnt);
+	}
+
+	/* loop through each filter and update the rules on the snapshot */
+	for (iter = 0; iter < col->filter_cnt; iter++) {
+		filter_o = col->filters[iter];
+		filter_s = snap->filters[iter];
+
+		/* skip ahead to the new rule(s) */
+		rule_o = filter_o->rules;
+		rule_s = filter_s->rules;
+		if (rule_o == NULL)
+			/* nothing to shadow */
+			continue;
+		if (rule_s != NULL) {
+			do {
+				rule_o = rule_o->next;
+				rule_s = rule_s->next;
+			} while (rule_s != filter_s->rules);
+
+			/* did we actually add any rules? */
+			if (rule_o == filter_o->rules)
+				/* no, we are done in this case */
+				continue;
+		}
+
+		/* update the old snapshot to make it a shadow */
+		do {
+			/* duplicate the rule */
+			rule_s = db_rule_dup(rule_o);
+			if (rule_s == NULL)
+				goto shadow_err;
+
+			/* add the rule */
+			rc = _db_col_rule_add(filter_s, rule_s);
+			if (rc != 0) {
+				free(rule_s);
+				goto shadow_err;
+			}
+
+			/* next rule */
+			rule_o = rule_o->next;
+		} while (rule_o != filter_o->rules);
+	}
+
+	/* success, mark the snapshot as a shadow and return */
+	snap->shadow = true;
+	return;
+
+shadow_err:
+	/* we failed making a shadow, cleanup and return */
 	col->snapshots = snap->next;
 	_db_snap_release(snap);
+	return;
 }