trivial optimisation for seccomp-bpf

When doing arg inspection and the syscall doesn't match, skip
past the instruction that reloads the syscall into the accumulator,
since the accumulator hasn't been modified at this point.

1 files changed, 1 insertions, 1 deletions

diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
index badfee2ec..c1fe1f3e9 100644
--- a/sandbox-seccomp-filter.c
+++ b/sandbox-seccomp-filter.c
@@ -81,7 +81,7 @@
         BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_ ## _nr, 0, 1), \
         BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
 #define SC_ALLOW_ARG(_nr, _arg_nr, _arg_val) \
-        BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_ ## _nr, 0, 3), \
+        BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_ ## _nr, 0, 4), \
         /* load first syscall argument */ \
         BPF_STMT(BPF_LD+BPF_W+BPF_ABS, \
             offsetof(struct seccomp_data, args[(_arg_nr)])), \