On Saturday, April 11, 2020 8:58:48 AM EDT John Reiser wrote:
On 4/11/20 4:38 AM, Kevin Kofler wrote:
Steve Grubb wrote:
readelf -s $f 2>/dev/null | grep FUNC | egrep 'seccomp_rule_add|seccomp'
Since seccomp is a substring of seccomp_rule_add, it is pointless to grep for both.
Yes, the output is the same. But the documentation is not as explicit. A comment might be helpful: ... | grep seccomp # also covers seccomp_rule_add
Precisely. The grep is to explicitly document there are 2 ways you can get into this. Direct use of the syscall, and use of libseccomp. There is a comment above explaining this, at least in my script..
-Steve