1 files changed, 1 insertions, 36 deletions

diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c
index 4a2221e98..4678f366b 100644
--- a/src/firejail/seccomp.c
+++ b/src/firejail/seccomp.c
@@ -92,20 +92,8 @@ int seccomp_load(const char *fname) {
         return 0;
 }
 
-
-
-
 // i386 filter installed on amd64 architectures
 void seccomp_filter_32(void) {
-        if (arg_debug)
-                printf("Build secondary 32-bit filter\n");
-
-        // build the seccomp filter as a regular user
-        int rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 4,
-                PATH_FSECCOMP, "secondary", "32", RUN_SECCOMP_I386);
-        if (rv)
-                exit(rv);
-
         if (seccomp_load(RUN_SECCOMP_I386) == 0) {
                 if (arg_debug)
                         printf("Dual i386/amd64 seccomp filter configured\n");
@@ -114,22 +102,12 @@ void seccomp_filter_32(void) {
 
 // amd64 filter installed on i386 architectures
 void seccomp_filter_64(void) {
-        if (arg_debug)
-                printf("Build secondary 64-bit filter\n");
-
-        // build the seccomp filter as a regular user
-        int rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 4,
-                PATH_FSECCOMP, "secondary", "64", RUN_SECCOMP_AMD64);
-        if (rv)
-                exit(rv);
-
         if (seccomp_load(RUN_SECCOMP_AMD64) == 0) {
                 if (arg_debug)
                         printf("Dual i386/amd64 seccomp filter configured\n");
         }
 }
 
-
 // drop filter for seccomp option
 int seccomp_filter_drop(int enforce_seccomp) {
         // default seccomp
@@ -140,20 +118,7 @@ int seccomp_filter_drop(int enforce_seccomp) {
 #if defined(__i386__)
                 seccomp_filter_64();
 #endif
-                if (arg_debug)
-                        printf("Build default seccomp filter\n");
-                // build the seccomp filter as a regular user
-                int rv;
-                if (arg_allow_debuggers)
-                        rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 4,
-                                PATH_FSECCOMP, "default", RUN_SECCOMP_CFG, "allow-debuggers");
-                else
-                        rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 3,
-                                PATH_FSECCOMP, "default", RUN_SECCOMP_CFG);
-                if (rv)
-                        exit(rv);
         }
-
         // default seccomp filter with additional drop list
         else if (cfg.seccomp_list && cfg.seccomp_list_drop == NULL) {
 #if defined(__x86_64__)
@@ -208,7 +173,7 @@ int seccomp_filter_drop(int enforce_seccomp) {
                 exit(1);
         }
         
-        if (arg_debug)
+        if (arg_debug && access(PATH_FSECCOMP, X_OK) == 0)
                 sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 3,
                         PATH_FSECCOMP, "print", RUN_SECCOMP_CFG);