Improve seccomp support for non-x86 architectures

3 files changed, 18 insertions, 18 deletions

diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 435b9527d..60a43a600 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -54,15 +54,15 @@
 
 #define RUN_SECCOMP_PROTOCOL    "/run/firejail/mnt/seccomp.protocol"    // protocol filter
 #define RUN_SECCOMP_CFG "/run/firejail/mnt/seccomp"                     // configured filter
-#define RUN_SECCOMP_AMD64       "/run/firejail/mnt/seccomp.amd64"       // amd64 filter installed on i386 architectures
-#define RUN_SECCOMP_I386        "/run/firejail/mnt/seccomp.i386"                // i386 filter installed on amd64 architectures
+#define RUN_SECCOMP_64  "/run/firejail/mnt/seccomp.64"          // 64bit arch filter installed on 32bit architectures
+#define RUN_SECCOMP_32  "/run/firejail/mnt/seccomp.32"          // 32bit arch filter installed on 64bit architectures
 #define RUN_SECCOMP_MDWX        "/run/firejail/mnt/seccomp.mdwx"                // filter for memory-deny-write-execute
 #define RUN_SECCOMP_BLOCK_SECONDARY     "/run/firejail/mnt/seccomp.block_secondary"     // secondary arch blocking filter
 #define RUN_SECCOMP_POSTEXEC    "/run/firejail/mnt/seccomp.postexec"            // filter for post-exec library
 #define PATH_SECCOMP_DEFAULT (LIBDIR "/firejail/seccomp")                       // default filter built during make
 #define PATH_SECCOMP_DEFAULT_DEBUG (LIBDIR "/firejail/seccomp.debug")   // default filter built during make
-#define PATH_SECCOMP_AMD64 (LIBDIR "/firejail/seccomp.amd64")           // amd64 filter built during make
-#define PATH_SECCOMP_I386 (LIBDIR "/firejail/seccomp.i386")                     // i386 filter built during make
+#define PATH_SECCOMP_64 (LIBDIR "/firejail/seccomp.64")                 // 64bit arch filter built during make
+#define PATH_SECCOMP_32 (LIBDIR "/firejail/seccomp.32")                 // 32bit arch filter built during make
 #define PATH_SECCOMP_MDWX (LIBDIR "/firejail/seccomp.mdwx")             // filter for memory-deny-write-execute built during make
 #define PATH_SECCOMP_BLOCK_SECONDARY (LIBDIR "/firejail/seccomp.block_secondary")       // secondary arch blocking filter built during make
 
diff --git a/src/firejail/preproc.c b/src/firejail/preproc.c
index bf1ef0469..0b447e03b 100644
--- a/src/firejail/preproc.c
+++ b/src/firejail/preproc.c
@@ -79,8 +79,8 @@ void preproc_mount_mnt_dir(void) {
                         copy_file(PATH_SECCOMP_BLOCK_SECONDARY, RUN_SECCOMP_BLOCK_SECONDARY, getuid(), getgid(), 0644); // root needed
                 else {
                         //copy default seccomp files
-                        copy_file(PATH_SECCOMP_I386, RUN_SECCOMP_I386, getuid(), getgid(), 0644); // root needed
-                        copy_file(PATH_SECCOMP_AMD64, RUN_SECCOMP_AMD64, getuid(), getgid(), 0644); // root needed
+                        copy_file(PATH_SECCOMP_32, RUN_SECCOMP_32, getuid(), getgid(), 0644); // root needed
+                        copy_file(PATH_SECCOMP_64, RUN_SECCOMP_64, getuid(), getgid(), 0644); // root needed
                 }
                 if (arg_allow_debuggers)
                         copy_file(PATH_SECCOMP_DEFAULT_DEBUG, RUN_SECCOMP_CFG, getuid(), getgid(), 0644); // root needed
diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c
index 7b45e2574..e75863c3a 100644
--- a/src/firejail/seccomp.c
+++ b/src/firejail/seccomp.c
@@ -137,22 +137,22 @@ errexit:
         exit(1);
 }
 
-// i386 filter installed on amd64 architectures
-#if defined(__x86_64__)
+// 32 bit arch filter installed on 64 bit architectures
+#if defined(__LP64__)
 static void seccomp_filter_32(void) {
-        if (seccomp_load(RUN_SECCOMP_I386) == 0) {
+        if (seccomp_load(RUN_SECCOMP_32) == 0) {
                 if (arg_debug)
-                        printf("Dual i386/amd64 seccomp filter configured\n");
+                        printf("Dual 32/64 bit seccomp filter configured\n");
         }
 }
 #endif
 
-// amd64 filter installed on i386 architectures
-#if defined(__i386__)
+// 64 bit arch filter installed on 32 bit architectures
+#if defined(__ILP32__)
 static void seccomp_filter_64(void) {
-        if (seccomp_load(RUN_SECCOMP_AMD64) == 0) {
+        if (seccomp_load(RUN_SECCOMP_64) == 0) {
                 if (arg_debug)
-                        printf("Dual i386/amd64 seccomp filter configured\n");
+                        printf("Dual 32/64 bit seccomp filter configured\n");
         }
 }
 #endif
@@ -177,10 +177,10 @@ int seccomp_filter_drop(void) {
                         if (arg_seccomp_block_secondary)
                                 seccomp_filter_block_secondary();
                         else {
-#if defined(__x86_64__)
+#if defined(__LP64__)
                                 seccomp_filter_32();
 #endif
-#if defined(__i386__)
+#if defined(__ILP32__)
                                 seccomp_filter_64();
 #endif
                         }
@@ -190,10 +190,10 @@ int seccomp_filter_drop(void) {
                         if (arg_seccomp_block_secondary)
                                 seccomp_filter_block_secondary();
                         else {
-#if defined(__x86_64__)
+#if defined(__LP64__)
                                 seccomp_filter_32();
 #endif
-#if defined(__i386__)
+#if defined(__ILP32__)
                                 seccomp_filter_64();
 #endif
                         }