Remove unused function

For quite some time we only use the trapping for multiple syscalls at
once, so we can remove the BPF filter for trapping just one syscall.

Author: vimpostor

README.md

@@ -38,7 +38,7 @@ Using this method it is also incredibly cumbersome to overwrite system call argu
 Recent advancements in the [Seccomp Notifier](https://people.kernel.org/brauner/the-seccomp-notifier-cranking-up-the-crazy-with-bpf) API have made it possible to intercept any system call in a much more elegant way.
 This also offers significant speed improvements, now the performance impact is closer to running the application in a container.
 
-For a more detailed explanation see the [accompanying blog posts](https://blog.mggross.com/intercepting-syscalls/).
+For a more detailed explanation see the [accompanying blog post](https://blog.mggross.com/intercepting-syscalls/).
 
 # Rules format
 

src/bin/seccomp/seccomp_trap.c

@@ -70,30 +70,6 @@ int recv_fd(int sock)
 	return *((int *)CMSG_DATA(cmsg));
 }
 
-int user_trap_syscall(int nr, unsigned int flags)
-{
-	struct sock_filter filter[] = {
-		// Check that architecture matches
-		// https://www.kernel.org/doc/html/latest/userspace-api/seccomp_filter.html#pitfalls
-		BPF_STMT(BPF_LD+BPF_W+BPF_ABS, (offsetof(struct seccomp_data, arch))),
-		BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, AUDIT_ARCH_X86_64, 0, 2),
-		BPF_STMT(BPF_LD+BPF_W+BPF_ABS, (offsetof(struct seccomp_data, nr))),
-		BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, X32_SYSCALL_BIT, 0, 1),
-		BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL_PROCESS),
-		// decide wheter to allow the syscall
-		BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, nr, 0, 1),
-		BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_USER_NOTIF),
-		BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
-	};
-
-	struct sock_fprog prog = {
-		.len = (unsigned short)ARRAY_SIZE(filter),
-		.filter = filter,
-	};
-
-	return seccomp(SECCOMP_SET_MODE_FILTER, flags, &prog);
-}
-
 int user_trap_syscalls(const int *nrs, size_t length, unsigned int flags) {
 	struct sock_filter filter[MAX_FILTER_SIZE];
 	int i = 0;

src/bin/seccomp/seccomp_trap.h

@@ -25,5 +25,4 @@
 int seccomp(unsigned int op, unsigned int flags, void *args);
 int send_fd(int sock, int fd);
 int recv_fd(int sock);
-int user_trap_syscall(int nr, unsigned int flags);
 int user_trap_syscalls(const int *nrs, size_t length, unsigned int flags);