Commit Graph

1115 Commits

Author SHA1 Message Date
Yu Watanabe 479667c497 nspawn: sort headers 2020-12-18 13:27:44 +09:00
Lennart Poettering a8af734e75
Merge pull request #17026 from fw-strlen/nft_16
add networkd/nspawn nftables backend
2020-12-16 19:18:22 +01:00
Zbigniew Jędrzejewski-Szmek e2054217d5 Move hostname setup logic to new shared/hostname-setup.[ch]
No functional change, just moving a bunch of things around. Before
we needed a rather complicated setup to test hostname_setup(), because
the code was in src/core/. When things are moved to src/shared/
we can just test it as any function.

The test is still "unsafe" because hostname_setup() may modify the
hostname.
2020-12-16 11:02:15 +01:00
Florian Westphal 715a70e721 firewall-util: add nftables backend
Idea is to use a static ruleset, added when the first attempt to
add a masquerade or dnat rule is made.

The alternative would be to add the ruleset when the init function is called.
The disadvantage is that this enables connection tracking and NAT in the kernel
(as the ruleset needs this to work), which comes with some overhead that might
not be needed (no nspawn usage and no IPMasquerade option set).

There is no additional dependency on the 'nft' userspace binary or other libraries.
sd-netlinks nfnetlink backend is used to modify the nftables ruleset.

The commit message/comments still use nft syntax since that is what
users will see when they use the nft tool to list the ruleset.

The added initial skeleton (added on first fw_add_masquerade/local_dnat
call) looks like this:

table ip io.systemd.nat {
        set masq_saddr {
                type ipv4_addr
                flags interval
                elements = { 192.168.59.160/28 }
        }

        map map_port_ipport {
                type inet_proto . inet_service : ipv4_addr . inet_service
                elements = { tcp . 2222 : 192.168.59.169 . 22 }
        }

        chain prerouting {
                type nat hook prerouting priority dstnat + 1; policy accept;
                fib daddr type local dnat ip addr . port to meta l4proto . th dport map @map_port_ipport
        }

        chain output {
                type nat hook output priority -99; policy accept;
                ip daddr != 127.0.0.0/8 oif "lo" dnat ip addr . port to meta l4proto . th dport map @map_port_ipport
        }

        chain postrouting {
                type nat hook postrouting priority srcnat + 1; policy accept;
                ip saddr @masq_saddr masquerade
        }
}

Next calls to fw_add_masquerade/add_local_dnat will then only add/delete the
element/mapping to masq_saddr and map_port_ipport, i.e. the ruleset doesn't
change -- only the set/map content does.

Running test-firewall-util with this backend gives following output
on a parallel 'nft monitor':

$ nft monitor
add table ip io.systemd.nat
add chain ip io.systemd.nat prerouting { type nat hook prerouting priority dstnat + 1; policy accept; }
add chain ip io.systemd.nat output { type nat hook output priority -99; policy accept; }
add chain ip io.systemd.nat postrouting { type nat hook postrouting priority srcnat + 1; policy accept; }
add set ip io.systemd.nat masq_saddr { type ipv4_addr; flags interval; }
add map ip io.systemd.nat map_port_ipport { type inet_proto . inet_service : ipv4_addr . inet_service; }
add rule ip io.systemd.nat prerouting fib daddr type local dnat ip addr . port to meta l4proto . th dport map @map_port_ipport
add rule ip io.systemd.nat output ip daddr != 127.0.0.0/8 fib daddr type local dnat ip addr . port to meta l4proto . th dport map @map_port_ipport
add rule ip io.systemd.nat postrouting ip saddr @masq_saddr masquerade
add element ip io.systemd.nat masq_saddr { 10.1.2.3 }
add element ip io.systemd.nat masq_saddr { 10.0.2.0/28 }
delete element ip io.systemd.nat masq_saddr { 10.0.2.0/28 }
delete element ip io.systemd.nat masq_saddr { 10.1.2.3 }
add element ip io.systemd.nat map_port_ipport { tcp . 4711 : 1.2.3.4 . 815 }
delete element ip io.systemd.nat map_port_ipport { tcp . 4711 : 1.2.3.4 . 815 }
add element ip io.systemd.nat map_port_ipport { tcp . 4711 : 1.2.3.5 . 815 }
delete element ip io.systemd.nat map_port_ipport { tcp . 4711 : 1.2.3.5 . 815 }
CTRL-C

Things not implemented/supported:
1. Change monitoring.  The kernel allows userspace to learn about changes
   made by other clients (using nfnetlink notifications). It would be
   possible to detect when e.g. someone removes the systemd nat table.
   This would need more work.  Its also not clear on how to react to
   external changes -- it doesn't seem like a good idea to just auto-undo
   everthing.
2. 'set masq_saddr' doesn't handle overlaps.
   Example:

   fw_add_masquerade(true, AF_INET, "10.0.0.0" , 16);
   fw_add_masquerade(true, AF_INET, "10.0.0.0" , 8); /* fails */

With the iptables backend the second call works, as it adds an
independent iptables rule.

With the nftables backend, the range 10.0.0.0-10.255.255.255 clashes with
the existing range of 10.0.0.0-10.0.255.255 so 2nd add gets rejected by the
kernel.

This will generate an error message from networkd ("Could not enable IP
masquerading: File exists").

To resolve this it would be needed to either keep track of the added elements
and perform range merging when overlaps are detected.

However, the add erquests are done using the configured network on a
device, so no overlaps should occur in normal setups.

IPv6 support is added in a extra changeset.

Fixes: #13307
2020-12-16 01:07:08 +01:00
Florian Westphal 761cf19d7b firewall-util: introduce context structure
for planned nft backend we have three choices:

- open/close a new nfnetlink socket for every operation
- keep a nfnetlink socket open internally
- expose a opaque fw_ctx and stash all internal data here.

Originally I opted for the 2nd option, but during review it was
suggested to avoid static storage duration because of perceived
problems with threaded applications.

This adds fw_ctx and new/free functions, then converts the existing api
and nspawn and networkd to use it.
2020-12-16 00:35:56 +01:00
Florian Westphal f51343d0af nspawn: pass userdata pointer, not inet_addr union
Next patch will need to pass two pointers to the callback instead
of just the addr mask.  Caller will pass a compound structure, so
make this 'void *userdata' to de-clutter the next patch.
2020-12-16 00:35:56 +01:00
Lennart Poettering 52ef5dd798 hostname-util: flagsify hostname_is_valid(), drop machine_name_is_valid()
Let's clean up hostname_is_valid() a bit: let's turn the second boolean
argument into a more explanatory flags field, and add a flag that
accepts the special name ".host" as valid. This is useful for the
container logic, where the special hostname ".host" refers to the "root
container", i.e. the host system itself, and can be specified at various
places.

let's also get rid of machine_name_is_valid(). It was just an alias,
which is confusing and even more so now that we have the flags param.
2020-12-15 17:59:48 +01:00
Ilya Dmitrichenko 65af8442df nspawn: remove outdated comment regarding bpffs
bpffs fully respects mount namespaces since kernel version 4.7

References:

- e27f4a942a
- 612bacad78
2020-12-14 10:50:42 +01:00
Torsten Hilbrich 88fc9c9bad systemd-nspawn: Allow setting ambient capability set
The old code was only able to pass the value 0 for the inheritable
and ambient capability set when a non-root user was specified.

However, sometimes it is useful to run a program in its own container
with a user specification and some capabilities set. This is needed
when the capabilities cannot be provided by file capabilities (because
the file system is mounted with MS_NOSUID for additional security).

This commit introduces the option --ambient-capability and the config
file option AmbientCapability=. Both are used in a similar way to the
existing Capability= setting. It changes the inheritable and ambient
set (which is 0 by default). The code also checks that the settings
for the bounding set (as defined by Capability= and DropCapability=)
and the setting for the ambient set (as defined by AmbientCapability=)
are compatible. Otherwise, the operation would fail in any way.

Due to the current use of -1 to indicate no support for ambient
capability set the special value "all" cannot be supported.

Also, the setting of ambient capability is restricted to running a
single program in the container payload.
2020-12-07 19:56:59 +01:00
Florian Westphal 67b3732a53 fw_add_local_dnat: remove unused function arguments
All users pass a NULL/0 for those, things haven't changed since 2015
when this was added originally, so remove the arguments.

THe paramters are re-added as local function variables, initalised
to NULL or 0.  A followup patch can then manually remove all
if (NULL) rather than leaving dead-branch optimization to compiler.

Reason for not doing it here is to ease patch review.

Not requiring support for this will ease initial nftables backend
implementation.
In case a use-case comues up later this feature can be re-added.
2020-12-03 11:04:46 +01:00
Lennart Poettering 986311c2da fileio: teach read_full_file_full() to read from offset/with maximum size 2020-12-01 14:17:47 +01:00
Yu Watanabe db9ecf0501 license: LGPL-2.1+ -> LGPL-2.1-or-later 2020-11-09 13:23:58 +09:00
Lennart Poettering ce8f6d478e seccomp: allow turning off of seccomp filtering via env var
Fixes: #17504

(While we are it, also move $SYSTEMD_SECCOMP_LOG= env var description
into the right document section)

Also suggested in: https://github.com/systemd/systemd/issues/17245#issuecomment-704773603
2020-11-05 20:22:19 +01:00
Lennart Poettering d3dcf4e3b9 fileio: beef up READ_FULL_FILE_CONNECT_SOCKET to allow setting sender socket name
This beefs up the READ_FULL_FILE_CONNECT_SOCKET logic of
read_full_file_full() a bit: when used a sender socket name may be
specified. If specified as NULL behaviour is as before: the client
socket name is picked by the kernel. But if specified as non-NULL the
client can pick a socket name to use when connecting. This is useful to
communicate a minimal amount of metainformation from client to server,
outside of the transport payload.

Specifically, these beefs up the service credential logic to pass an
abstract AF_UNIX socket name as client socket name when connecting via
READ_FULL_FILE_CONNECT_SOCKET, that includes the requesting unit name
and the eventual credential name. This allows servers implementing the
trivial credential socket logic to distinguish clients: via a simple
getpeername() it can be determined which unit is requesting a
credential, and which credential specifically.

Example: with this patch in place, in a unit file "waldo.service" a
configuration line like the following:

    LoadCredential=foo:/run/quux/creds.sock

will result in a connection to the AF_UNIX socket /run/quux/creds.sock,
originating from an abstract namespace AF_UNIX socket:

    @$RANDOM/unit/waldo.service/foo

(The $RANDOM is replaced by some randomized string. This is included in
the socket name order to avoid namespace squatting issues: the abstract
socket namespace is open to unprivileged users after all, and care needs
to be taken not to use guessable names)

The services listening on the /run/quux/creds.sock socket may thus
easily retrieve the name of the unit the credential is requested for
plus the credential name, via a simpler getpeername(), discarding the
random preifx and the /unit/ string.

This logic uses "/" as separator between the fields, since both unit
names and credential names appear in the file system, and thus are
designed to use "/" as outer separators. Given that it's a good safe
choice to use as separators here, too avoid any conflicts.

This is a minimal patch only: the new logic is used only for the unit
file credential logic. For other places where we use
READ_FULL_FILE_CONNECT_SOCKET it is probably a good idea to use this
scheme too, but this should be done carefully in later patches, since
the socket names become API that way, and we should determine the right
amount of info to pass over.
2020-11-03 09:48:04 +01:00
Harald Seiler c5fbeedb0c nspawn: robustly deal with "uninitialized" machine-id
When nspawn starts an image, this image could be in any state, including
an aborted first boot.  For this case, it needs to correctly handle the
situation like there was no machine-id at all.
2020-10-19 16:28:21 +02:00
Frantisek Sumsal d7a0f1f4f9 tree-wide: assorted coccinelle fixes 2020-10-09 15:02:23 +02:00
Lennart Poettering 3462d773d2 nspawn: don't chown() stdin/stdout passed in when --console=pipe is used
We should chown what we allocate ourselves, i.e. any pty we allocate
ourselves. But for stuff we propagate, let's avoid that: we shouldn't
make more changes than necessary.

Fixes: #17229
2020-10-02 12:05:08 +02:00
Zbigniew Jędrzejewski-Szmek 38ee19c04b nspawn: give better message when invoked as non-root without arguments
When invoked as non-root, we would suggest re-running as root without any
further hint. But this immediately spawns a machine from the local directory,
which can be rather surprising. So let's give a better hint.

(In general, I don't think commandline programs should do "significant" things
when invoked without any arguments. In this regard it would be better if
systemd-nspawn would not spawn a machine from the current directory if called
with no arguments and at least "-D ." would be required.)
2020-09-24 16:36:51 +02:00
Lennart Poettering 30f5d10421 mount-util: rework umount_verbose() to take log level and flags arg
Let's make umount_verbose() more like mount_verbose_xyz(), i.e. take log
level and flags param. In particular the latter matters, since we
typically don't actually want to follow symlinks when unmounting.
2020-09-23 18:57:36 +02:00
Lennart Poettering 511a8cfe30 mount-util: switch most mount_verbose() code over to not follow symlinks 2020-09-23 18:57:36 +02:00
Lennart Poettering 065b47749d tree-wide: use ERRNO_IS_PRIVILEGE() whereever appropriate 2020-09-22 16:25:22 +02:00
Lennart Poettering aee36b4ea2 dissect-image: process /usr/ GPT partition type 2020-09-19 21:19:51 +02:00
Lennart Poettering 10e8a60baa nspawn: add --console=autopipe mode
By default we'll run a container in --console=interactive and
--console=read-only mode depending if we are invoked on a tty or not so
that the container always gets a /dev/console allocated, i.e is always
suitable to run a full init system /as those typically expect a
/dev/console to exist).

With the new --console=autopipe mode we do something similar, but
slightly different: when not invoked on a tty we'll use --console=pipe.
This means, if you invoke some tool in a container with this you'll get
full inetractivity if you invoke it on a tty but things will also be
very nicely pipeable. OTOH you cannot invoke a full init system like
this, because you might or might not become a /dev/console this way...

Prompted-by: #17070

(I named this "autopipe" rather than "auto" or so, since the default
mode probably should be named "auto" one day if we add a name for it,
and this is so similar to "auto" except that it uses pipes in the
non-tty case).
2020-09-17 16:39:27 +02:00
Lennart Poettering 335d2eadca nspawn: don't become TTY controller just to undo it later again
Instead of first becoming a controlling process of the payload pty
as side effect of opening it (without O_NOCTTY), and then possibly
dropping it again, let's do it cleanly an reverse the logic: let's open
the pty without becoming its controller first. Only after everything
went the way we wanted it to go become the controller explicitly.

This has the benefit that the PID 1 stub process we run (as effect of
--as-pid2) doesn't have to lose the tty explicitly, but can just
continue running with things. And we explicitly make the tty controlling
right before invoking actual payload.

In order to make sure everything works as expected validate that the
stub PID 1 in the container really has no conrolling tty by issuing the
TIOCNOTTY tty and expecting ENOTTY, and log about it.

This shouldn't change behaviour much, it just makes thins a bit cleaner,
in particular as we'll not trigger SIGHUP on ourselves (since we are
controller and session leader) due to TIOCNOTTY which we then have to
explicitly ignore.
2020-09-17 16:39:23 +02:00
Lennart Poettering 2fef50cd9e nspawn: fix fd leak on failure path 2020-09-17 16:39:19 +02:00
Lennart Poettering 554c4beb47 nspawn: print log notice when we are invoked from a tty but in "pipe" mode
If people do this then things are weird, and they should probably use
--console=interactive (i.e. the default) instead.

Prompted-by: #17070
2020-09-17 16:39:16 +02:00
Lennart Poettering efe4266240 nspawn: check return of setsid()
Let's verify that everything works the way we expect it to work, hence
check setsid() return code.
2020-09-17 16:38:58 +02:00
Lennart Poettering 89e62e0bd3 dissect: wrap verity settings in new VeritySettings structure
Just some refactoring: let's place the various verity related parameters
in a common structure, and pass that around instead of the individual
parameters.

Also, let's load the PKCS#7 signature data when finding metadata
right-away, instead of delaying this until we need it. In all cases we
call this there's not much time difference between the metdata finding
and the loading, hence this simplifies things and makes sure root hash
data and its signature is now always acquired together.
2020-09-17 20:36:23 +09:00
Yu Watanabe a864170745 nspawn: downgrade log level if the error will be ignored 2020-09-10 15:16:14 +09:00
Zbigniew Jędrzejewski-Szmek 90e30d767a Rename strv_split_extract() to strv_split_full()
Now that _full() is gone, we can rename _extract() to have the usual suffix
we use for the more featureful version.
2020-09-09 09:34:55 +02:00
Zbigniew Jędrzejewski-Szmek 087908c140 nspawn: use extract_first_word() 2020-09-09 09:34:54 +02:00
Lennart Poettering 58cf204730 nspawn: let's make LinkJournal an extended boolean
Let's accept the usual boolean parameters for LinkJournal. It's
confusing otherwise.

Previously we'd accept "no" but not the other values we typically accept
for "false". We'd not accept any values for "true".

With this change we'll accept all true and false values and will do
something somewhat reasonable: any false value is treated like "no"
previously was reated. And any true value is now treated like "auto".

We don't document the new values, since this logic is mostly redundant,
and it's probably better if people consider this an enum rather than a
bool.

Fixes: #16888
2020-09-02 08:57:44 +02:00
Lennart Poettering 3652872add nspawn: add --set-credential= and --load-credential=
Let's allow passing in creds to containers, so that PID 1 inside the
container can pick them up.
2020-08-25 19:45:47 +02:00
Zbigniew Jędrzejewski-Szmek 9f56c88aeb
Merge pull request #16819 from keszybz/seccomp-enosys
Return ENOSYS in nspawn for "unknown" syscalls
2020-08-25 09:18:46 +02:00
Zbigniew Jędrzejewski-Szmek d75615f398 nspawn: turn on higher optimization level in seccomp
$ sudo ./dump_seccomp_filter $PIDOF_NSPAWN_PAYLOAD obj
$ ~/src/libseccomp/build/tools/scmp_bpf_disasm <obj

Before the addition of @known to filter:
 line  OP   JT   JF   K
=================================
 0000: 0x20 0x00 0x00 0x00000004   ld  $data[4]
 0001: 0x15 0x00 0x6d 0x40000003   jeq 1073741827 true:0002 false:0111
 0002: 0x20 0x00 0x00 0x00000000   ld  $data[0]
 0003: 0x15 0x6b 0x00 0x00000000   jeq 0    true:0111 false:0004
 0004: 0x15 0x6a 0x00 0x00000001   jeq 1    true:0111 false:0005
 0005: 0x15 0x69 0x00 0x00000002   jeq 2    true:0111 false:0006
 0006: 0x15 0x68 0x00 0x00000003   jeq 3    true:0111 false:0007
 0007: 0x15 0x67 0x00 0x00000004   jeq 4    true:0111 false:0008
 0008: 0x15 0x66 0x00 0x00000005   jeq 5    true:0111 false:0009
 0009: 0x15 0x65 0x00 0x00000006   jeq 6    true:0111 false:0010
 0010: 0x15 0x64 0x00 0x00000007   jeq 7    true:0111 false:0011
 0011: 0x15 0x63 0x00 0x00000008   jeq 8    true:0111 false:0012
 0012: 0x15 0x62 0x00 0x00000009   jeq 9    true:0111 false:0013
 0013: 0x15 0x61 0x00 0x0000000a   jeq 10   true:0111 false:0014
 0014: 0x15 0x60 0x00 0x0000000b   jeq 11   true:0111 false:0015
 0015: 0x15 0x5f 0x00 0x0000000c   jeq 12   true:0111 false:0016
 0016: 0x15 0x5e 0x00 0x0000000d   jeq 13   true:0111 false:0017
 0017: 0x15 0x5d 0x00 0x0000000e   jeq 14   true:0111 false:0018
 0018: 0x15 0x5c 0x00 0x0000000f   jeq 15   true:0111 false:0019
 0019: 0x15 0x5b 0x00 0x00000010   jeq 16   true:0111 false:0020
 0020: 0x15 0x5a 0x00 0x00000012   jeq 18   true:0111 false:0021
 0021: 0x15 0x59 0x00 0x00000013   jeq 19   true:0111 false:0022
 0022: 0x15 0x58 0x00 0x00000014   jeq 20   true:0111 false:0023
 0023: 0x15 0x57 0x00 0x00000015   jeq 21   true:0111 false:0024
 0024: 0x15 0x56 0x00 0x00000016   jeq 22   true:0111 false:0025
 0025: 0x15 0x55 0x00 0x00000017   jeq 23   true:0111 false:0026
 0026: 0x15 0x54 0x00 0x00000018   jeq 24   true:0111 false:0027
 0027: 0x15 0x53 0x00 0x0000001a   jeq 26   true:0111 false:0028
 0028: 0x15 0x52 0x00 0x0000001b   jeq 27   true:0111 false:0029
 0029: 0x15 0x51 0x00 0x0000001c   jeq 28   true:0111 false:0030
 0030: 0x15 0x50 0x00 0x0000001d   jeq 29   true:0111 false:0031
 0031: 0x15 0x4f 0x00 0x0000001e   jeq 30   true:0111 false:0032
 0032: 0x15 0x4e 0x00 0x00000021   jeq 33   true:0111 false:0033
 0033: 0x15 0x4d 0x00 0x00000022   jeq 34   true:0111 false:0034
 0034: 0x15 0x4c 0x00 0x00000024   jeq 36   true:0111 false:0035
 0035: 0x15 0x4b 0x00 0x00000025   jeq 37   true:0111 false:0036
 0036: 0x15 0x4a 0x00 0x00000026   jeq 38   true:0111 false:0037
 0037: 0x15 0x49 0x00 0x00000027   jeq 39   true:0111 false:0038
 0038: 0x15 0x48 0x00 0x00000028   jeq 40   true:0111 false:0039
 0039: 0x15 0x47 0x00 0x00000029   jeq 41   true:0111 false:0040
 0040: 0x15 0x46 0x00 0x0000002a   jeq 42   true:0111 false:0041
 0041: 0x15 0x45 0x00 0x0000002b   jeq 43   true:0111 false:0042
 0042: 0x15 0x44 0x00 0x0000002d   jeq 45   true:0111 false:0043
 0043: 0x15 0x43 0x00 0x0000002e   jeq 46   true:0111 false:0044
 0044: 0x15 0x42 0x00 0x0000002f   jeq 47   true:0111 false:0045
 0045: 0x15 0x41 0x00 0x00000030   jeq 48   true:0111 false:0046
 0046: 0x15 0x40 0x00 0x00000031   jeq 49   true:0111 false:0047
 0047: 0x15 0x3f 0x00 0x00000032   jeq 50   true:0111 false:0048
 0048: 0x15 0x3e 0x00 0x00000034   jeq 52   true:0111 false:0049
 0049: 0x15 0x3d 0x00 0x00000036   jeq 54   true:0111 false:0050
 0050: 0x15 0x3c 0x00 0x00000037   jeq 55   true:0111 false:0051
 0051: 0x15 0x3b 0x00 0x00000039   jeq 57   true:0111 false:0052
 0052: 0x15 0x3a 0x00 0x0000003b   jeq 59   true:0111 false:0053
 0053: 0x15 0x39 0x00 0x0000003c   jeq 60   true:0111 false:0054
 0054: 0x15 0x38 0x00 0x0000003d   jeq 61   true:0111 false:0055
 0055: 0x15 0x37 0x00 0x0000003f   jeq 63   true:0111 false:0056
 0056: 0x15 0x36 0x00 0x00000040   jeq 64   true:0111 false:0057
 0057: 0x15 0x35 0x00 0x00000041   jeq 65   true:0111 false:0058
 0058: 0x15 0x34 0x00 0x00000042   jeq 66   true:0111 false:0059
 0059: 0x15 0x33 0x00 0x00000043   jeq 67   true:0111 false:0060
 0060: 0x15 0x32 0x00 0x00000046   jeq 70   true:0111 false:0061
 0061: 0x15 0x31 0x00 0x00000047   jeq 71   true:0111 false:0062
 0062: 0x15 0x30 0x00 0x00000048   jeq 72   true:0111 false:0063
 0063: 0x15 0x2f 0x00 0x00000049   jeq 73   true:0111 false:0064
 0064: 0x15 0x2e 0x00 0x0000004a   jeq 74   true:0111 false:0065
 0065: 0x15 0x2d 0x00 0x0000004b   jeq 75   true:0111 false:0066
 0066: 0x15 0x2c 0x00 0x0000004c   jeq 76   true:0111 false:0067
 0067: 0x15 0x2b 0x00 0x0000004d   jeq 77   true:0111 false:0068
 0068: 0x15 0x2a 0x00 0x0000004e   jeq 78   true:0111 false:0069
 0069: 0x15 0x29 0x00 0x00000050   jeq 80   true:0111 false:0070
 0070: 0x15 0x28 0x00 0x00000051   jeq 81   true:0111 false:0071
 0071: 0x15 0x27 0x00 0x00000052   jeq 82   true:0111 false:0072
 0072: 0x15 0x26 0x00 0x00000053   jeq 83   true:0111 false:0073
 0073: 0x15 0x25 0x00 0x00000054   jeq 84   true:0111 false:0074
 0074: 0x15 0x24 0x00 0x00000055   jeq 85   true:0111 false:0075
 0075: 0x15 0x23 0x00 0x00000058   jeq 88   true:0111 false:0076
 0076: 0x15 0x22 0x00 0x00000059   jeq 89   true:0111 false:0077
 0077: 0x15 0x21 0x00 0x0000005a   jeq 90   true:0111 false:0078
 0078: 0x15 0x20 0x00 0x0000005b   jeq 91   true:0111 false:0079
 0079: 0x15 0x1f 0x00 0x0000005c   jeq 92   true:0111 false:0080
 0080: 0x15 0x1e 0x00 0x0000005d   jeq 93   true:0111 false:0081
 0081: 0x15 0x1d 0x00 0x0000005e   jeq 94   true:0111 false:0082
 0082: 0x15 0x1c 0x00 0x0000005f   jeq 95   true:0111 false:0083
 0083: 0x15 0x1b 0x00 0x00000060   jeq 96   true:0111 false:0084
 0084: 0x15 0x1a 0x00 0x00000061   jeq 97   true:0111 false:0085
 0085: 0x15 0x19 0x00 0x00000063   jeq 99   true:0111 false:0086
 0086: 0x15 0x18 0x00 0x00000064   jeq 100  true:0111 false:0087
 0087: 0x15 0x17 0x00 0x00000066   jeq 102  true:0111 false:0088
 0088: 0x15 0x16 0x00 0x00000068   jeq 104  true:0111 false:0089
 0089: 0x15 0x15 0x00 0x00000069   jeq 105  true:0111 false:0090
 0090: 0x15 0x14 0x00 0x0000006a   jeq 106  true:0111 false:0091
 0091: 0x15 0x13 0x00 0x0000006b   jeq 107  true:0111 false:0092
 0092: 0x15 0x12 0x00 0x0000006c   jeq 108  true:0111 false:0093
 0093: 0x15 0x11 0x00 0x0000006d   jeq 109  true:0111 false:0094
 0094: 0x15 0x10 0x00 0x0000006f   jeq 111  true:0111 false:0095
 0095: 0x15 0x0f 0x00 0x00000072   jeq 114  true:0111 false:0096
 0096: 0x15 0x0e 0x00 0x00000074   jeq 116  true:0111 false:0097
 0097: 0x15 0x0d 0x00 0x00000075   jeq 117  true:0111 false:0098
 0098: 0x15 0x0c 0x00 0x00000076   jeq 118  true:0111 false:0099
 0099: 0x15 0x0b 0x00 0x00000077   jeq 119  true:0111 false:0100
 0100: 0x15 0x0a 0x00 0x00000078   jeq 120  true:0111 false:0101
 0101: 0x15 0x09 0x00 0x00000079   jeq 121  true:0111 false:0102
 0102: 0x15 0x08 0x00 0x0000007a   jeq 122  true:0111 false:0103
 0103: 0x15 0x07 0x00 0x0000007d   jeq 125  true:0111 false:0104
 0104: 0x15 0x06 0x00 0x0000007e   jeq 126  true:0111 false:0105
 0105: 0x15 0x05 0x00 0x00000084   jeq 132  true:0111 false:0106
 0106: 0x15 0x04 0x00 0x00000085   jeq 133  true:0111 false:0107
 0107: 0x15 0x03 0x00 0x00000088   jeq 136  true:0111 false:0108
 0108: 0x15 0x02 0x00 0x0000008a   jeq 138  true:0111 false:0109
 0109: 0x15 0x01 0x00 0x0000008b   jeq 139  true:0111 false:0110
 0110: 0x15 0x00 0x01 0x0000008c   jeq 140  true:0111 false:0112
 0111: 0x06 0x00 0x00 0x7fff0000   ret ALLOW
 0112: 0x15 0xff 0x00 0x0000008d   jeq 141  true:0368 false:0113
 0113: 0x15 0xfe 0x00 0x0000008e   jeq 142  true:0368 false:0114
 0114: 0x15 0xfd 0x00 0x0000008f   jeq 143  true:0368 false:0115
 0115: 0x15 0xfc 0x00 0x00000090   jeq 144  true:0368 false:0116
 0116: 0x15 0xfb 0x00 0x00000091   jeq 145  true:0368 false:0117
 0117: 0x15 0xfa 0x00 0x00000092   jeq 146  true:0368 false:0118
 0118: 0x15 0xf9 0x00 0x00000093   jeq 147  true:0368 false:0119
 0119: 0x15 0xf8 0x00 0x00000094   jeq 148  true:0368 false:0120
 0120: 0x15 0xf7 0x00 0x0000009a   jeq 154  true:0368 false:0121
 0121: 0x15 0xf6 0x00 0x0000009b   jeq 155  true:0368 false:0122
 0122: 0x15 0xf5 0x00 0x0000009c   jeq 156  true:0368 false:0123
 0123: 0x15 0xf4 0x00 0x0000009d   jeq 157  true:0368 false:0124
 0124: 0x15 0xf3 0x00 0x0000009e   jeq 158  true:0368 false:0125
 0125: 0x15 0xf2 0x00 0x0000009f   jeq 159  true:0368 false:0126
 0126: 0x15 0xf1 0x00 0x000000a0   jeq 160  true:0368 false:0127
 0127: 0x15 0xf0 0x00 0x000000a1   jeq 161  true:0368 false:0128
 0128: 0x15 0xef 0x00 0x000000a2   jeq 162  true:0368 false:0129
 0129: 0x15 0xee 0x00 0x000000a3   jeq 163  true:0368 false:0130
 0130: 0x15 0xed 0x00 0x000000a4   jeq 164  true:0368 false:0131
 0131: 0x15 0xec 0x00 0x000000a5   jeq 165  true:0368 false:0132
 0132: 0x15 0xeb 0x00 0x000000a8   jeq 168  true:0368 false:0133
 0133: 0x15 0xea 0x00 0x000000aa   jeq 170  true:0368 false:0134
 0134: 0x15 0xe9 0x00 0x000000ab   jeq 171  true:0368 false:0135
 0135: 0x15 0xe8 0x00 0x000000ac   jeq 172  true:0368 false:0136
 0136: 0x15 0xe7 0x00 0x000000ad   jeq 173  true:0368 false:0137
 0137: 0x15 0xe6 0x00 0x000000ae   jeq 174  true:0368 false:0138
 0138: 0x15 0xe5 0x00 0x000000af   jeq 175  true:0368 false:0139
 0139: 0x15 0xe4 0x00 0x000000b0   jeq 176  true:0368 false:0140
 0140: 0x15 0xe3 0x00 0x000000b1   jeq 177  true:0368 false:0141
 0141: 0x15 0xe2 0x00 0x000000b2   jeq 178  true:0368 false:0142
 0142: 0x15 0xe1 0x00 0x000000b3   jeq 179  true:0368 false:0143
 0143: 0x15 0xe0 0x00 0x000000b4   jeq 180  true:0368 false:0144
 0144: 0x15 0xdf 0x00 0x000000b5   jeq 181  true:0368 false:0145
 0145: 0x15 0xde 0x00 0x000000b6   jeq 182  true:0368 false:0146
 0146: 0x15 0xdd 0x00 0x000000b7   jeq 183  true:0368 false:0147
 0147: 0x15 0xdc 0x00 0x000000b8   jeq 184  true:0368 false:0148
 0148: 0x15 0xdb 0x00 0x000000b9   jeq 185  true:0368 false:0149
 0149: 0x15 0xda 0x00 0x000000ba   jeq 186  true:0368 false:0150
 0150: 0x15 0xd9 0x00 0x000000bb   jeq 187  true:0368 false:0151
 0151: 0x15 0xd8 0x00 0x000000be   jeq 190  true:0368 false:0152
 0152: 0x15 0xd7 0x00 0x000000bf   jeq 191  true:0368 false:0153
 0153: 0x15 0xd6 0x00 0x000000c0   jeq 192  true:0368 false:0154
 0154: 0x15 0xd5 0x00 0x000000c1   jeq 193  true:0368 false:0155
 0155: 0x15 0xd4 0x00 0x000000c2   jeq 194  true:0368 false:0156
 0156: 0x15 0xd3 0x00 0x000000c3   jeq 195  true:0368 false:0157
 0157: 0x15 0xd2 0x00 0x000000c4   jeq 196  true:0368 false:0158
 0158: 0x15 0xd1 0x00 0x000000c5   jeq 197  true:0368 false:0159
 0159: 0x15 0xd0 0x00 0x000000c6   jeq 198  true:0368 false:0160
 0160: 0x15 0xcf 0x00 0x000000c7   jeq 199  true:0368 false:0161
 0161: 0x15 0xce 0x00 0x000000c8   jeq 200  true:0368 false:0162
 0162: 0x15 0xcd 0x00 0x000000c9   jeq 201  true:0368 false:0163
 0163: 0x15 0xcc 0x00 0x000000ca   jeq 202  true:0368 false:0164
 0164: 0x15 0xcb 0x00 0x000000cb   jeq 203  true:0368 false:0165
 0165: 0x15 0xca 0x00 0x000000cc   jeq 204  true:0368 false:0166
 0166: 0x15 0xc9 0x00 0x000000cd   jeq 205  true:0368 false:0167
 0167: 0x15 0xc8 0x00 0x000000ce   jeq 206  true:0368 false:0168
 0168: 0x15 0xc7 0x00 0x000000cf   jeq 207  true:0368 false:0169
 0169: 0x15 0xc6 0x00 0x000000d0   jeq 208  true:0368 false:0170
 0170: 0x15 0xc5 0x00 0x000000d1   jeq 209  true:0368 false:0171
 0171: 0x15 0xc4 0x00 0x000000d2   jeq 210  true:0368 false:0172
 0172: 0x15 0xc3 0x00 0x000000d3   jeq 211  true:0368 false:0173
 0173: 0x15 0xc2 0x00 0x000000d4   jeq 212  true:0368 false:0174
 0174: 0x15 0xc1 0x00 0x000000d5   jeq 213  true:0368 false:0175
 0175: 0x15 0xc0 0x00 0x000000d6   jeq 214  true:0368 false:0176
 0176: 0x15 0xbf 0x00 0x000000d7   jeq 215  true:0368 false:0177
 0177: 0x15 0xbe 0x00 0x000000d8   jeq 216  true:0368 false:0178
 0178: 0x15 0xbd 0x00 0x000000d9   jeq 217  true:0368 false:0179
 0179: 0x15 0xbc 0x00 0x000000da   jeq 218  true:0368 false:0180
 0180: 0x15 0xbb 0x00 0x000000db   jeq 219  true:0368 false:0181
 0181: 0x15 0xba 0x00 0x000000dc   jeq 220  true:0368 false:0182
 0182: 0x15 0xb9 0x00 0x000000dd   jeq 221  true:0368 false:0183
 0183: 0x15 0xb8 0x00 0x000000e0   jeq 224  true:0368 false:0184
 0184: 0x15 0xb7 0x00 0x000000e1   jeq 225  true:0368 false:0185
 0185: 0x15 0xb6 0x00 0x000000e2   jeq 226  true:0368 false:0186
 0186: 0x15 0xb5 0x00 0x000000e3   jeq 227  true:0368 false:0187
 0187: 0x15 0xb4 0x00 0x000000e4   jeq 228  true:0368 false:0188
 0188: 0x15 0xb3 0x00 0x000000e5   jeq 229  true:0368 false:0189
 0189: 0x15 0xb2 0x00 0x000000e6   jeq 230  true:0368 false:0190
 0190: 0x15 0xb1 0x00 0x000000e7   jeq 231  true:0368 false:0191
 0191: 0x15 0xb0 0x00 0x000000e8   jeq 232  true:0368 false:0192
 0192: 0x15 0xaf 0x00 0x000000e9   jeq 233  true:0368 false:0193
 0193: 0x15 0xae 0x00 0x000000ea   jeq 234  true:0368 false:0194
 0194: 0x15 0xad 0x00 0x000000eb   jeq 235  true:0368 false:0195
 0195: 0x15 0xac 0x00 0x000000ec   jeq 236  true:0368 false:0196
 0196: 0x15 0xab 0x00 0x000000ed   jeq 237  true:0368 false:0197
 0197: 0x15 0xaa 0x00 0x000000ee   jeq 238  true:0368 false:0198
 0198: 0x15 0xa9 0x00 0x000000ef   jeq 239  true:0368 false:0199
 0199: 0x15 0xa8 0x00 0x000000f0   jeq 240  true:0368 false:0200
 0200: 0x15 0xa7 0x00 0x000000f1   jeq 241  true:0368 false:0201
 0201: 0x15 0xa6 0x00 0x000000f2   jeq 242  true:0368 false:0202
 0202: 0x15 0xa5 0x00 0x000000f3   jeq 243  true:0368 false:0203
 0203: 0x15 0xa4 0x00 0x000000f4   jeq 244  true:0368 false:0204
 0204: 0x15 0xa3 0x00 0x000000f5   jeq 245  true:0368 false:0205
 0205: 0x15 0xa2 0x00 0x000000f6   jeq 246  true:0368 false:0206
 0206: 0x15 0xa1 0x00 0x000000f7   jeq 247  true:0368 false:0207
 0207: 0x15 0xa0 0x00 0x000000f8   jeq 248  true:0368 false:0208
 0208: 0x15 0x9f 0x00 0x000000f9   jeq 249  true:0368 false:0209
 0209: 0x15 0x9e 0x00 0x000000fa   jeq 250  true:0368 false:0210
 0210: 0x15 0x9d 0x00 0x000000fc   jeq 252  true:0368 false:0211
 0211: 0x15 0x9c 0x00 0x000000fe   jeq 254  true:0368 false:0212
 0212: 0x15 0x9b 0x00 0x000000ff   jeq 255  true:0368 false:0213
 0213: 0x15 0x9a 0x00 0x00000100   jeq 256  true:0368 false:0214
 0214: 0x15 0x99 0x00 0x00000101   jeq 257  true:0368 false:0215
 0215: 0x15 0x98 0x00 0x00000102   jeq 258  true:0368 false:0216
 0216: 0x15 0x97 0x00 0x00000103   jeq 259  true:0368 false:0217
 0217: 0x15 0x96 0x00 0x00000104   jeq 260  true:0368 false:0218
 0218: 0x15 0x95 0x00 0x00000105   jeq 261  true:0368 false:0219
 0219: 0x15 0x94 0x00 0x00000106   jeq 262  true:0368 false:0220
 0220: 0x15 0x93 0x00 0x00000107   jeq 263  true:0368 false:0221
 0221: 0x15 0x92 0x00 0x00000109   jeq 265  true:0368 false:0222
 0222: 0x15 0x91 0x00 0x0000010a   jeq 266  true:0368 false:0223
 0223: 0x15 0x90 0x00 0x0000010b   jeq 267  true:0368 false:0224
 0224: 0x15 0x8f 0x00 0x0000010c   jeq 268  true:0368 false:0225
 0225: 0x15 0x8e 0x00 0x0000010d   jeq 269  true:0368 false:0226
 0226: 0x15 0x8d 0x00 0x0000010e   jeq 270  true:0368 false:0227
 0227: 0x15 0x8c 0x00 0x0000010f   jeq 271  true:0368 false:0228
 0228: 0x15 0x8b 0x00 0x00000110   jeq 272  true:0368 false:0229
 0229: 0x15 0x8a 0x00 0x00000112   jeq 274  true:0368 false:0230
 0230: 0x15 0x89 0x00 0x00000113   jeq 275  true:0368 false:0231
 0231: 0x15 0x88 0x00 0x00000114   jeq 276  true:0368 false:0232
 0232: 0x15 0x87 0x00 0x00000115   jeq 277  true:0368 false:0233
 0233: 0x15 0x86 0x00 0x00000116   jeq 278  true:0368 false:0234
 0234: 0x15 0x85 0x00 0x00000117   jeq 279  true:0368 false:0235
 0235: 0x15 0x84 0x00 0x00000118   jeq 280  true:0368 false:0236
 0236: 0x15 0x83 0x00 0x00000119   jeq 281  true:0368 false:0237
 0237: 0x15 0x82 0x00 0x0000011a   jeq 282  true:0368 false:0238
 0238: 0x15 0x81 0x00 0x0000011c   jeq 284  true:0368 false:0239
 0239: 0x15 0x80 0x00 0x00000121   jeq 289  true:0368 false:0240
 0240: 0x15 0x7f 0x00 0x00000122   jeq 290  true:0368 false:0241
 0241: 0x15 0x7e 0x00 0x00000123   jeq 291  true:0368 false:0242
 0242: 0x15 0x7d 0x00 0x00000124   jeq 292  true:0368 false:0243
 0243: 0x15 0x7c 0x00 0x00000125   jeq 293  true:0368 false:0244
 0244: 0x15 0x7b 0x00 0x00000126   jeq 294  true:0368 false:0245
 0245: 0x15 0x7a 0x00 0x00000127   jeq 295  true:0368 false:0246
 0246: 0x15 0x79 0x00 0x00000128   jeq 296  true:0368 false:0247
 0247: 0x15 0x78 0x00 0x00000129   jeq 297  true:0368 false:0248
 0248: 0x15 0x77 0x00 0x0000012a   jeq 298  true:0368 false:0249
 0249: 0x15 0x76 0x00 0x0000012b   jeq 299  true:0368 false:0250
 0250: 0x15 0x75 0x00 0x0000012c   jeq 300  true:0368 false:0251
 0251: 0x15 0x74 0x00 0x0000012d   jeq 301  true:0368 false:0252
 0252: 0x15 0x73 0x00 0x0000012e   jeq 302  true:0368 false:0253
 0253: 0x15 0x72 0x00 0x0000012f   jeq 303  true:0368 false:0254
 0254: 0x15 0x71 0x00 0x00000130   jeq 304  true:0368 false:0255
 0255: 0x15 0x70 0x00 0x00000131   jeq 305  true:0368 false:0256
 0256: 0x15 0x6f 0x00 0x00000132   jeq 306  true:0368 false:0257
 0257: 0x15 0x6e 0x00 0x00000133   jeq 307  true:0368 false:0258
 0258: 0x15 0x6d 0x00 0x00000134   jeq 308  true:0368 false:0259
 0259: 0x15 0x6c 0x00 0x00000135   jeq 309  true:0368 false:0260
 0260: 0x15 0x6b 0x00 0x00000136   jeq 310  true:0368 false:0261
 0261: 0x15 0x6a 0x00 0x00000137   jeq 311  true:0368 false:0262
 0262: 0x15 0x69 0x00 0x00000138   jeq 312  true:0368 false:0263
 0263: 0x15 0x68 0x00 0x00000139   jeq 313  true:0368 false:0264
 0264: 0x15 0x67 0x00 0x0000013a   jeq 314  true:0368 false:0265
 0265: 0x15 0x66 0x00 0x0000013b   jeq 315  true:0368 false:0266
 0266: 0x15 0x65 0x00 0x0000013c   jeq 316  true:0368 false:0267
 0267: 0x15 0x64 0x00 0x0000013d   jeq 317  true:0368 false:0268
 0268: 0x15 0x63 0x00 0x0000013e   jeq 318  true:0368 false:0269
 0269: 0x15 0x62 0x00 0x0000013f   jeq 319  true:0368 false:0270
 0270: 0x15 0x61 0x00 0x00000140   jeq 320  true:0368 false:0271
 0271: 0x15 0x60 0x00 0x00000141   jeq 321  true:0368 false:0272
 0272: 0x15 0x5f 0x00 0x00000142   jeq 322  true:0368 false:0273
 0273: 0x15 0x5e 0x00 0x00000143   jeq 323  true:0368 false:0274
 0274: 0x15 0x5d 0x00 0x00000144   jeq 324  true:0368 false:0275
 0275: 0x15 0x5c 0x00 0x00000145   jeq 325  true:0368 false:0276
 0276: 0x15 0x5b 0x00 0x00000146   jeq 326  true:0368 false:0277
 0277: 0x15 0x5a 0x00 0x00000147   jeq 327  true:0368 false:0278
 0278: 0x15 0x59 0x00 0x00000148   jeq 328  true:0368 false:0279
 0279: 0x15 0x58 0x00 0x00000149   jeq 329  true:0368 false:0280
 0280: 0x15 0x57 0x00 0x0000014a   jeq 330  true:0368 false:0281
 0281: 0x15 0x56 0x00 0x0000014b   jeq 331  true:0368 false:0282
 0282: 0x15 0x55 0x00 0x0000014c   jeq 332  true:0368 false:0283
 0283: 0x15 0x54 0x00 0x0000014d   jeq 333  true:0368 false:0284
 0284: 0x15 0x53 0x00 0x0000014e   jeq 334  true:0368 false:0285
 0285: 0x15 0x52 0x00 0x0000014f   jeq 335  true:0368 false:0286
 0286: 0x15 0x51 0x00 0x00000151   jeq 337  true:0368 false:0287
 0287: 0x15 0x50 0x00 0x00000154   jeq 340  true:0368 false:0288
 0288: 0x15 0x4f 0x00 0x00000155   jeq 341  true:0368 false:0289
 0289: 0x15 0x4e 0x00 0x00000158   jeq 344  true:0368 false:0290
 0290: 0x15 0x4d 0x00 0x00000159   jeq 345  true:0368 false:0291
 0291: 0x15 0x4c 0x00 0x0000015a   jeq 346  true:0368 false:0292
 0292: 0x15 0x4b 0x00 0x0000015b   jeq 347  true:0368 false:0293
 0293: 0x15 0x4a 0x00 0x0000015c   jeq 348  true:0368 false:0294
 0294: 0x15 0x49 0x00 0x0000015d   jeq 349  true:0368 false:0295
 0295: 0x15 0x48 0x00 0x0000015f   jeq 351  true:0368 false:0296
 0296: 0x15 0x47 0x00 0x00000160   jeq 352  true:0368 false:0297
 0297: 0x15 0x46 0x00 0x00000161   jeq 353  true:0368 false:0298
 0298: 0x15 0x45 0x00 0x00000162   jeq 354  true:0368 false:0299
 0299: 0x15 0x44 0x00 0x00000163   jeq 355  true:0368 false:0300
 0300: 0x15 0x43 0x00 0x00000164   jeq 356  true:0368 false:0301
 0301: 0x15 0x42 0x00 0x00000166   jeq 358  true:0368 false:0302
 0302: 0x15 0x41 0x00 0x00000167   jeq 359  true:0368 false:0303
 0303: 0x15 0x40 0x00 0x00000168   jeq 360  true:0368 false:0304
 0304: 0x15 0x3f 0x00 0x00000169   jeq 361  true:0368 false:0305
 0305: 0x15 0x3e 0x00 0x0000016a   jeq 362  true:0368 false:0306
 0306: 0x15 0x3d 0x00 0x0000016b   jeq 363  true:0368 false:0307
 0307: 0x15 0x3c 0x00 0x0000016c   jeq 364  true:0368 false:0308
 0308: 0x15 0x3b 0x00 0x0000016d   jeq 365  true:0368 false:0309
 0309: 0x15 0x3a 0x00 0x0000016e   jeq 366  true:0368 false:0310
 0310: 0x15 0x39 0x00 0x0000016f   jeq 367  true:0368 false:0311
 0311: 0x15 0x38 0x00 0x00000170   jeq 368  true:0368 false:0312
 0312: 0x15 0x37 0x00 0x00000171   jeq 369  true:0368 false:0313
 0313: 0x15 0x36 0x00 0x00000172   jeq 370  true:0368 false:0314
 0314: 0x15 0x35 0x00 0x00000173   jeq 371  true:0368 false:0315
 0315: 0x15 0x34 0x00 0x00000174   jeq 372  true:0368 false:0316
 0316: 0x15 0x33 0x00 0x00000175   jeq 373  true:0368 false:0317
 0317: 0x15 0x32 0x00 0x00000176   jeq 374  true:0368 false:0318
 0318: 0x15 0x31 0x00 0x00000177   jeq 375  true:0368 false:0319
 0319: 0x15 0x30 0x00 0x00000179   jeq 377  true:0368 false:0320
 0320: 0x15 0x2f 0x00 0x0000017a   jeq 378  true:0368 false:0321
 0321: 0x15 0x2e 0x00 0x0000017b   jeq 379  true:0368 false:0322
 0322: 0x15 0x2d 0x00 0x0000017f   jeq 383  true:0368 false:0323
 0323: 0x15 0x2c 0x00 0x00000180   jeq 384  true:0368 false:0324
 0324: 0x15 0x2b 0x00 0x00000181   jeq 385  true:0368 false:0325
 0325: 0x15 0x2a 0x00 0x00000182   jeq 386  true:0368 false:0326
 0326: 0x15 0x29 0x00 0x00000189   jeq 393  true:0368 false:0327
 0327: 0x15 0x28 0x00 0x0000018a   jeq 394  true:0368 false:0328
 0328: 0x15 0x27 0x00 0x0000018b   jeq 395  true:0368 false:0329
 0329: 0x15 0x26 0x00 0x0000018c   jeq 396  true:0368 false:0330
 0330: 0x15 0x25 0x00 0x0000018d   jeq 397  true:0368 false:0331
 0331: 0x15 0x24 0x00 0x0000018e   jeq 398  true:0368 false:0332
 0332: 0x15 0x23 0x00 0x0000018f   jeq 399  true:0368 false:0333
 0333: 0x15 0x22 0x00 0x00000190   jeq 400  true:0368 false:0334
 0334: 0x15 0x21 0x00 0x00000191   jeq 401  true:0368 false:0335
 0335: 0x15 0x20 0x00 0x00000192   jeq 402  true:0368 false:0336
 0336: 0x15 0x1f 0x00 0x00000193   jeq 403  true:0368 false:0337
 0337: 0x15 0x1e 0x00 0x00000196   jeq 406  true:0368 false:0338
 0338: 0x15 0x1d 0x00 0x00000197   jeq 407  true:0368 false:0339
 0339: 0x15 0x1c 0x00 0x00000198   jeq 408  true:0368 false:0340
 0340: 0x15 0x1b 0x00 0x00000199   jeq 409  true:0368 false:0341
 0341: 0x15 0x1a 0x00 0x0000019a   jeq 410  true:0368 false:0342
 0342: 0x15 0x19 0x00 0x0000019b   jeq 411  true:0368 false:0343
 0343: 0x15 0x18 0x00 0x0000019c   jeq 412  true:0368 false:0344
 0344: 0x15 0x17 0x00 0x0000019d   jeq 413  true:0368 false:0345
 0345: 0x15 0x16 0x00 0x0000019e   jeq 414  true:0368 false:0346
 0346: 0x15 0x15 0x00 0x000001a0   jeq 416  true:0368 false:0347
 0347: 0x15 0x14 0x00 0x000001a1   jeq 417  true:0368 false:0348
 0348: 0x15 0x13 0x00 0x000001a2   jeq 418  true:0368 false:0349
 0349: 0x15 0x12 0x00 0x000001a3   jeq 419  true:0368 false:0350
 0350: 0x15 0x11 0x00 0x000001a4   jeq 420  true:0368 false:0351
 0351: 0x15 0x10 0x00 0x000001a5   jeq 421  true:0368 false:0352
 0352: 0x15 0x0f 0x00 0x000001a6   jeq 422  true:0368 false:0353
 0353: 0x15 0x0e 0x00 0x000001a8   jeq 424  true:0368 false:0354
 0354: 0x15 0x0d 0x00 0x000001a9   jeq 425  true:0368 false:0355
 0355: 0x15 0x0c 0x00 0x000001aa   jeq 426  true:0368 false:0356
 0356: 0x15 0x0b 0x00 0x000001ab   jeq 427  true:0368 false:0357
 0357: 0x15 0x0a 0x00 0x000001ac   jeq 428  true:0368 false:0358
 0358: 0x15 0x09 0x00 0x000001ad   jeq 429  true:0368 false:0359
 0359: 0x15 0x08 0x00 0x000001ae   jeq 430  true:0368 false:0360
 0360: 0x15 0x07 0x00 0x000001af   jeq 431  true:0368 false:0361
 0361: 0x15 0x06 0x00 0x000001b0   jeq 432  true:0368 false:0362
 0362: 0x15 0x05 0x00 0x000001b1   jeq 433  true:0368 false:0363
 0363: 0x15 0x04 0x00 0x000001b2   jeq 434  true:0368 false:0364
 0364: 0x15 0x03 0x00 0x000001b3   jeq 435  true:0368 false:0365
 0365: 0x15 0x02 0x00 0x000001b5   jeq 437  true:0368 false:0366
 0366: 0x15 0x01 0x00 0x000001b7   jeq 439  true:0368 false:0367
 0367: 0x06 0x00 0x00 0x00050001   ret ERRNO(1)
 0368: 0x06 0x00 0x00 0x7fff0000   ret ALLOW

After the addition of @known:
 line  OP   JT   JF   K
=================================
 0000: 0x20 0x00 0x00 0x00000004   ld  $data[4]
 0001: 0x15 0x00 0xa4 0x40000003   jeq 1073741827 true:0002 false:0166
 0002: 0x20 0x00 0x00 0x00000000   ld  $data[0]
 0003: 0x15 0xa2 0x00 0x00000000   jeq 0    true:0166 false:0004
 0004: 0x15 0xa1 0x00 0x00000001   jeq 1    true:0166 false:0005
 0005: 0x15 0xa0 0x00 0x00000002   jeq 2    true:0166 false:0006
 0006: 0x15 0x9f 0x00 0x00000003   jeq 3    true:0166 false:0007
 0007: 0x15 0x9e 0x00 0x00000004   jeq 4    true:0166 false:0008
 0008: 0x15 0x9d 0x00 0x00000005   jeq 5    true:0166 false:0009
 0009: 0x15 0x9c 0x00 0x00000006   jeq 6    true:0166 false:0010
 0010: 0x15 0x9b 0x00 0x00000007   jeq 7    true:0166 false:0011
 0011: 0x15 0x9a 0x00 0x00000008   jeq 8    true:0166 false:0012
 0012: 0x15 0x99 0x00 0x00000009   jeq 9    true:0166 false:0013
 0013: 0x15 0x98 0x00 0x0000000a   jeq 10   true:0166 false:0014
 0014: 0x15 0x97 0x00 0x0000000b   jeq 11   true:0166 false:0015
 0015: 0x15 0x96 0x00 0x0000000c   jeq 12   true:0166 false:0016
 0016: 0x15 0x95 0x00 0x0000000d   jeq 13   true:0166 false:0017
 0017: 0x15 0x94 0x00 0x0000000e   jeq 14   true:0166 false:0018
 0018: 0x15 0x93 0x00 0x0000000f   jeq 15   true:0166 false:0019
 0019: 0x15 0x92 0x00 0x00000010   jeq 16   true:0166 false:0020
 0020: 0x15 0x91 0x00 0x00000012   jeq 18   true:0166 false:0021
 0021: 0x15 0x90 0x00 0x00000013   jeq 19   true:0166 false:0022
 0022: 0x15 0x8f 0x00 0x00000014   jeq 20   true:0166 false:0023
 0023: 0x15 0x8e 0x00 0x00000015   jeq 21   true:0166 false:0024
 0024: 0x15 0x8d 0x00 0x00000016   jeq 22   true:0166 false:0025
 0025: 0x15 0x8c 0x00 0x00000017   jeq 23   true:0166 false:0026
 0026: 0x15 0x8b 0x00 0x00000018   jeq 24   true:0166 false:0027
 0027: 0x15 0x87 0x00 0x00000019   jeq 25   true:0163 false:0028
 0028: 0x15 0x89 0x00 0x0000001a   jeq 26   true:0166 false:0029
 0029: 0x15 0x88 0x00 0x0000001b   jeq 27   true:0166 false:0030
 0030: 0x15 0x87 0x00 0x0000001c   jeq 28   true:0166 false:0031
 0031: 0x15 0x86 0x00 0x0000001d   jeq 29   true:0166 false:0032
 0032: 0x15 0x85 0x00 0x0000001e   jeq 30   true:0166 false:0033
 0033: 0x15 0x84 0x00 0x00000021   jeq 33   true:0166 false:0034
 0034: 0x15 0x83 0x00 0x00000022   jeq 34   true:0166 false:0035
 0035: 0x15 0x82 0x00 0x00000024   jeq 36   true:0166 false:0036
 0036: 0x15 0x81 0x00 0x00000025   jeq 37   true:0166 false:0037
 0037: 0x15 0x80 0x00 0x00000026   jeq 38   true:0166 false:0038
 0038: 0x15 0x7f 0x00 0x00000027   jeq 39   true:0166 false:0039
 0039: 0x15 0x7e 0x00 0x00000028   jeq 40   true:0166 false:0040
 0040: 0x15 0x7d 0x00 0x00000029   jeq 41   true:0166 false:0041
 0041: 0x15 0x7c 0x00 0x0000002a   jeq 42   true:0166 false:0042
 0042: 0x15 0x7b 0x00 0x0000002b   jeq 43   true:0166 false:0043
 0043: 0x15 0x7a 0x00 0x0000002d   jeq 45   true:0166 false:0044
 0044: 0x15 0x79 0x00 0x0000002e   jeq 46   true:0166 false:0045
 0045: 0x15 0x78 0x00 0x0000002f   jeq 47   true:0166 false:0046
 0046: 0x15 0x77 0x00 0x00000030   jeq 48   true:0166 false:0047
 0047: 0x15 0x76 0x00 0x00000031   jeq 49   true:0166 false:0048
 0048: 0x15 0x75 0x00 0x00000032   jeq 50   true:0166 false:0049
 0049: 0x15 0x71 0x00 0x00000033   jeq 51   true:0163 false:0050
 0050: 0x15 0x73 0x00 0x00000034   jeq 52   true:0166 false:0051
 0051: 0x15 0x72 0x00 0x00000036   jeq 54   true:0166 false:0052
 0052: 0x15 0x71 0x00 0x00000037   jeq 55   true:0166 false:0053
 0053: 0x15 0x70 0x00 0x00000039   jeq 57   true:0166 false:0054
 0054: 0x15 0x6f 0x00 0x0000003b   jeq 59   true:0166 false:0055
 0055: 0x15 0x6e 0x00 0x0000003c   jeq 60   true:0166 false:0056
 0056: 0x15 0x6d 0x00 0x0000003d   jeq 61   true:0166 false:0057
 0057: 0x15 0x69 0x00 0x0000003e   jeq 62   true:0163 false:0058
 0058: 0x15 0x6b 0x00 0x0000003f   jeq 63   true:0166 false:0059
 0059: 0x15 0x6a 0x00 0x00000040   jeq 64   true:0166 false:0060
 0060: 0x15 0x69 0x00 0x00000041   jeq 65   true:0166 false:0061
 0061: 0x15 0x68 0x00 0x00000042   jeq 66   true:0166 false:0062
 0062: 0x15 0x67 0x00 0x00000043   jeq 67   true:0166 false:0063
 0063: 0x15 0x63 0x00 0x00000044   jeq 68   true:0163 false:0064
 0064: 0x15 0x62 0x00 0x00000045   jeq 69   true:0163 false:0065
 0065: 0x15 0x64 0x00 0x00000046   jeq 70   true:0166 false:0066
 0066: 0x15 0x63 0x00 0x00000047   jeq 71   true:0166 false:0067
 0067: 0x15 0x62 0x00 0x00000048   jeq 72   true:0166 false:0068
 0068: 0x15 0x61 0x00 0x00000049   jeq 73   true:0166 false:0069
 0069: 0x15 0x60 0x00 0x0000004a   jeq 74   true:0166 false:0070
 0070: 0x15 0x5f 0x00 0x0000004b   jeq 75   true:0166 false:0071
 0071: 0x15 0x5e 0x00 0x0000004c   jeq 76   true:0166 false:0072
 0072: 0x15 0x5d 0x00 0x0000004d   jeq 77   true:0166 false:0073
 0073: 0x15 0x5c 0x00 0x0000004e   jeq 78   true:0166 false:0074
 0074: 0x15 0x58 0x00 0x0000004f   jeq 79   true:0163 false:0075
 0075: 0x15 0x5a 0x00 0x00000050   jeq 80   true:0166 false:0076
 0076: 0x15 0x59 0x00 0x00000051   jeq 81   true:0166 false:0077
 0077: 0x15 0x58 0x00 0x00000052   jeq 82   true:0166 false:0078
 0078: 0x15 0x57 0x00 0x00000053   jeq 83   true:0166 false:0079
 0079: 0x15 0x56 0x00 0x00000054   jeq 84   true:0166 false:0080
 0080: 0x15 0x55 0x00 0x00000055   jeq 85   true:0166 false:0081
 0081: 0x15 0x51 0x00 0x00000056   jeq 86   true:0163 false:0082
 0082: 0x15 0x50 0x00 0x00000057   jeq 87   true:0163 false:0083
 0083: 0x15 0x52 0x00 0x00000058   jeq 88   true:0166 false:0084
 0084: 0x15 0x51 0x00 0x00000059   jeq 89   true:0166 false:0085
 0085: 0x15 0x50 0x00 0x0000005a   jeq 90   true:0166 false:0086
 0086: 0x15 0x4f 0x00 0x0000005b   jeq 91   true:0166 false:0087
 0087: 0x15 0x4e 0x00 0x0000005c   jeq 92   true:0166 false:0088
 0088: 0x15 0x4d 0x00 0x0000005d   jeq 93   true:0166 false:0089
 0089: 0x15 0x4c 0x00 0x0000005e   jeq 94   true:0166 false:0090
 0090: 0x15 0x4b 0x00 0x0000005f   jeq 95   true:0166 false:0091
 0091: 0x15 0x4a 0x00 0x00000060   jeq 96   true:0166 false:0092
 0092: 0x15 0x49 0x00 0x00000061   jeq 97   true:0166 false:0093
 0093: 0x15 0x48 0x00 0x00000063   jeq 99   true:0166 false:0094
 0094: 0x15 0x47 0x00 0x00000064   jeq 100  true:0166 false:0095
 0095: 0x15 0x43 0x00 0x00000065   jeq 101  true:0163 false:0096
 0096: 0x15 0x45 0x00 0x00000066   jeq 102  true:0166 false:0097
 0097: 0x15 0x41 0x00 0x00000067   jeq 103  true:0163 false:0098
 0098: 0x15 0x43 0x00 0x00000068   jeq 104  true:0166 false:0099
 0099: 0x15 0x42 0x00 0x00000069   jeq 105  true:0166 false:0100
 0100: 0x15 0x41 0x00 0x0000006a   jeq 106  true:0166 false:0101
 0101: 0x15 0x40 0x00 0x0000006b   jeq 107  true:0166 false:0102
 0102: 0x15 0x3f 0x00 0x0000006c   jeq 108  true:0166 false:0103
 0103: 0x15 0x3e 0x00 0x0000006d   jeq 109  true:0166 false:0104
 0104: 0x15 0x3a 0x00 0x0000006e   jeq 110  true:0163 false:0105
 0105: 0x15 0x3c 0x00 0x0000006f   jeq 111  true:0166 false:0106
 0106: 0x15 0x38 0x00 0x00000070   jeq 112  true:0163 false:0107
 0107: 0x15 0x37 0x00 0x00000071   jeq 113  true:0163 false:0108
 0108: 0x15 0x39 0x00 0x00000072   jeq 114  true:0166 false:0109
 0109: 0x15 0x35 0x00 0x00000073   jeq 115  true:0163 false:0110
 0110: 0x15 0x37 0x00 0x00000074   jeq 116  true:0166 false:0111
 0111: 0x15 0x36 0x00 0x00000075   jeq 117  true:0166 false:0112
 0112: 0x15 0x35 0x00 0x00000076   jeq 118  true:0166 false:0113
 0113: 0x15 0x34 0x00 0x00000077   jeq 119  true:0166 false:0114
 0114: 0x15 0x33 0x00 0x00000078   jeq 120  true:0166 false:0115
 0115: 0x15 0x32 0x00 0x00000079   jeq 121  true:0166 false:0116
 0116: 0x15 0x31 0x00 0x0000007a   jeq 122  true:0166 false:0117
 0117: 0x15 0x2d 0x00 0x0000007b   jeq 123  true:0163 false:0118
 0118: 0x15 0x2c 0x00 0x0000007c   jeq 124  true:0163 false:0119
 0119: 0x15 0x2e 0x00 0x0000007d   jeq 125  true:0166 false:0120
 0120: 0x15 0x2d 0x00 0x0000007e   jeq 126  true:0166 false:0121
 0121: 0x15 0x29 0x00 0x0000007f   jeq 127  true:0163 false:0122
 0122: 0x15 0x28 0x00 0x00000080   jeq 128  true:0163 false:0123
 0123: 0x15 0x27 0x00 0x00000081   jeq 129  true:0163 false:0124
 0124: 0x15 0x26 0x00 0x00000082   jeq 130  true:0163 false:0125
 0125: 0x15 0x25 0x00 0x00000083   jeq 131  true:0163 false:0126
 0126: 0x15 0x27 0x00 0x00000084   jeq 132  true:0166 false:0127
 0127: 0x15 0x26 0x00 0x00000085   jeq 133  true:0166 false:0128
 0128: 0x15 0x22 0x00 0x00000086   jeq 134  true:0163 false:0129
 0129: 0x15 0x21 0x00 0x00000087   jeq 135  true:0163 false:0130
 0130: 0x15 0x23 0x00 0x00000088   jeq 136  true:0166 false:0131
 0131: 0x15 0x22 0x00 0x0000008a   jeq 138  true:0166 false:0132
 0132: 0x15 0x21 0x00 0x0000008b   jeq 139  true:0166 false:0133
 0133: 0x15 0x20 0x00 0x0000008c   jeq 140  true:0166 false:0134
 0134: 0x15 0x1f 0x00 0x0000008d   jeq 141  true:0166 false:0135
 0135: 0x15 0x1e 0x00 0x0000008e   jeq 142  true:0166 false:0136
 0136: 0x15 0x1d 0x00 0x0000008f   jeq 143  true:0166 false:0137
 0137: 0x15 0x1c 0x00 0x00000090   jeq 144  true:0166 false:0138
 0138: 0x15 0x1b 0x00 0x00000091   jeq 145  true:0166 false:0139
 0139: 0x15 0x1a 0x00 0x00000092   jeq 146  true:0166 false:0140
 0140: 0x15 0x19 0x00 0x00000093   jeq 147  true:0166 false:0141
 0141: 0x15 0x18 0x00 0x00000094   jeq 148  true:0166 false:0142
 0142: 0x15 0x14 0x00 0x00000095   jeq 149  true:0163 false:0143
 0143: 0x15 0x13 0x00 0x00000096   jeq 150  true:0163 false:0144
 0144: 0x15 0x12 0x00 0x00000097   jeq 151  true:0163 false:0145
 0145: 0x15 0x11 0x00 0x00000098   jeq 152  true:0163 false:0146
 0146: 0x15 0x10 0x00 0x00000099   jeq 153  true:0163 false:0147
 0147: 0x15 0x12 0x00 0x0000009a   jeq 154  true:0166 false:0148
 0148: 0x15 0x11 0x00 0x0000009b   jeq 155  true:0166 false:0149
 0149: 0x15 0x10 0x00 0x0000009c   jeq 156  true:0166 false:0150
 0150: 0x15 0x0f 0x00 0x0000009d   jeq 157  true:0166 false:0151
 0151: 0x15 0x0e 0x00 0x0000009e   jeq 158  true:0166 false:0152
 0152: 0x15 0x0d 0x00 0x0000009f   jeq 159  true:0166 false:0153
 0153: 0x15 0x0c 0x00 0x000000a0   jeq 160  true:0166 false:0154
 0154: 0x15 0x0b 0x00 0x000000a1   jeq 161  true:0166 false:0155
 0155: 0x15 0x0a 0x00 0x000000a2   jeq 162  true:0166 false:0156
 0156: 0x15 0x09 0x00 0x000000a3   jeq 163  true:0166 false:0157
 0157: 0x15 0x08 0x00 0x000000a4   jeq 164  true:0166 false:0158
 0158: 0x15 0x07 0x00 0x000000a5   jeq 165  true:0166 false:0159
 0159: 0x15 0x03 0x00 0x000000a6   jeq 166  true:0163 false:0160
 0160: 0x15 0x02 0x00 0x000000a7   jeq 167  true:0163 false:0161
 0161: 0x15 0x04 0x00 0x000000a8   jeq 168  true:0166 false:0162
 0162: 0x15 0x00 0x01 0x000000a9   jeq 169  true:0163 false:0164
 0163: 0x06 0x00 0x00 0x00050001   ret ERRNO(1)
 0164: 0x15 0x01 0x00 0x000000aa   jeq 170  true:0166 false:0165
 0165: 0x15 0x00 0x01 0x000000ab   jeq 171  true:0166 false:0167
 0166: 0x06 0x00 0x00 0x7fff0000   ret ALLOW
 0167: 0x15 0xff 0x00 0x000000ac   jeq 172  true:0423 false:0168
 0168: 0x15 0xfe 0x00 0x000000ad   jeq 173  true:0423 false:0169
 0169: 0x15 0xfd 0x00 0x000000ae   jeq 174  true:0423 false:0170
 0170: 0x15 0xfc 0x00 0x000000af   jeq 175  true:0423 false:0171
 0171: 0x15 0xfb 0x00 0x000000b0   jeq 176  true:0423 false:0172
 0172: 0x15 0xfa 0x00 0x000000b1   jeq 177  true:0423 false:0173
 0173: 0x15 0xf9 0x00 0x000000b2   jeq 178  true:0423 false:0174
 0174: 0x15 0xf8 0x00 0x000000b3   jeq 179  true:0423 false:0175
 0175: 0x15 0xf7 0x00 0x000000b4   jeq 180  true:0423 false:0176
 0176: 0x15 0xf6 0x00 0x000000b5   jeq 181  true:0423 false:0177
 0177: 0x15 0xf5 0x00 0x000000b6   jeq 182  true:0423 false:0178
 0178: 0x15 0xf4 0x00 0x000000b7   jeq 183  true:0423 false:0179
 0179: 0x15 0xf3 0x00 0x000000b8   jeq 184  true:0423 false:0180
 0180: 0x15 0xf2 0x00 0x000000b9   jeq 185  true:0423 false:0181
 0181: 0x15 0xf1 0x00 0x000000ba   jeq 186  true:0423 false:0182
 0182: 0x15 0xf0 0x00 0x000000bb   jeq 187  true:0423 false:0183
 0183: 0x15 0xec 0x00 0x000000bc   jeq 188  true:0420 false:0184
 0184: 0x15 0xee 0x00 0x000000be   jeq 190  true:0423 false:0185
 0185: 0x15 0xed 0x00 0x000000bf   jeq 191  true:0423 false:0186
 0186: 0x15 0xec 0x00 0x000000c0   jeq 192  true:0423 false:0187
 0187: 0x15 0xeb 0x00 0x000000c1   jeq 193  true:0423 false:0188
 0188: 0x15 0xea 0x00 0x000000c2   jeq 194  true:0423 false:0189
 0189: 0x15 0xe9 0x00 0x000000c3   jeq 195  true:0423 false:0190
 0190: 0x15 0xe8 0x00 0x000000c4   jeq 196  true:0423 false:0191
 0191: 0x15 0xe7 0x00 0x000000c5   jeq 197  true:0423 false:0192
 0192: 0x15 0xe6 0x00 0x000000c6   jeq 198  true:0423 false:0193
 0193: 0x15 0xe5 0x00 0x000000c7   jeq 199  true:0423 false:0194
 0194: 0x15 0xe4 0x00 0x000000c8   jeq 200  true:0423 false:0195
 0195: 0x15 0xe3 0x00 0x000000c9   jeq 201  true:0423 false:0196
 0196: 0x15 0xe2 0x00 0x000000ca   jeq 202  true:0423 false:0197
 0197: 0x15 0xe1 0x00 0x000000cb   jeq 203  true:0423 false:0198
 0198: 0x15 0xe0 0x00 0x000000cc   jeq 204  true:0423 false:0199
 0199: 0x15 0xdf 0x00 0x000000cd   jeq 205  true:0423 false:0200
 0200: 0x15 0xde 0x00 0x000000ce   jeq 206  true:0423 false:0201
 0201: 0x15 0xdd 0x00 0x000000cf   jeq 207  true:0423 false:0202
 0202: 0x15 0xdc 0x00 0x000000d0   jeq 208  true:0423 false:0203
 0203: 0x15 0xdb 0x00 0x000000d1   jeq 209  true:0423 false:0204
 0204: 0x15 0xda 0x00 0x000000d2   jeq 210  true:0423 false:0205
 0205: 0x15 0xd9 0x00 0x000000d3   jeq 211  true:0423 false:0206
 0206: 0x15 0xd8 0x00 0x000000d4   jeq 212  true:0423 false:0207
 0207: 0x15 0xd7 0x00 0x000000d5   jeq 213  true:0423 false:0208
 0208: 0x15 0xd6 0x00 0x000000d6   jeq 214  true:0423 false:0209
 0209: 0x15 0xd5 0x00 0x000000d7   jeq 215  true:0423 false:0210
 0210: 0x15 0xd4 0x00 0x000000d8   jeq 216  true:0423 false:0211
 0211: 0x15 0xd3 0x00 0x000000d9   jeq 217  true:0423 false:0212
 0212: 0x15 0xd2 0x00 0x000000da   jeq 218  true:0423 false:0213
 0213: 0x15 0xd1 0x00 0x000000db   jeq 219  true:0423 false:0214
 0214: 0x15 0xd0 0x00 0x000000dc   jeq 220  true:0423 false:0215
 0215: 0x15 0xcf 0x00 0x000000dd   jeq 221  true:0423 false:0216
 0216: 0x15 0xce 0x00 0x000000e0   jeq 224  true:0423 false:0217
 0217: 0x15 0xcd 0x00 0x000000e1   jeq 225  true:0423 false:0218
 0218: 0x15 0xcc 0x00 0x000000e2   jeq 226  true:0423 false:0219
 0219: 0x15 0xcb 0x00 0x000000e3   jeq 227  true:0423 false:0220
 0220: 0x15 0xca 0x00 0x000000e4   jeq 228  true:0423 false:0221
 0221: 0x15 0xc9 0x00 0x000000e5   jeq 229  true:0423 false:0222
 0222: 0x15 0xc8 0x00 0x000000e6   jeq 230  true:0423 false:0223
 0223: 0x15 0xc7 0x00 0x000000e7   jeq 231  true:0423 false:0224
 0224: 0x15 0xc6 0x00 0x000000e8   jeq 232  true:0423 false:0225
 0225: 0x15 0xc5 0x00 0x000000e9   jeq 233  true:0423 false:0226
 0226: 0x15 0xc4 0x00 0x000000ea   jeq 234  true:0423 false:0227
 0227: 0x15 0xc3 0x00 0x000000eb   jeq 235  true:0423 false:0228
 0228: 0x15 0xc2 0x00 0x000000ec   jeq 236  true:0423 false:0229
 0229: 0x15 0xc1 0x00 0x000000ed   jeq 237  true:0423 false:0230
 0230: 0x15 0xc0 0x00 0x000000ee   jeq 238  true:0423 false:0231
 0231: 0x15 0xbf 0x00 0x000000ef   jeq 239  true:0423 false:0232
 0232: 0x15 0xbe 0x00 0x000000f0   jeq 240  true:0423 false:0233
 0233: 0x15 0xbd 0x00 0x000000f1   jeq 241  true:0423 false:0234
 0234: 0x15 0xbc 0x00 0x000000f2   jeq 242  true:0423 false:0235
 0235: 0x15 0xbb 0x00 0x000000f3   jeq 243  true:0423 false:0236
 0236: 0x15 0xba 0x00 0x000000f4   jeq 244  true:0423 false:0237
 0237: 0x15 0xb9 0x00 0x000000f5   jeq 245  true:0423 false:0238
 0238: 0x15 0xb8 0x00 0x000000f6   jeq 246  true:0423 false:0239
 0239: 0x15 0xb7 0x00 0x000000f7   jeq 247  true:0423 false:0240
 0240: 0x15 0xb6 0x00 0x000000f8   jeq 248  true:0423 false:0241
 0241: 0x15 0xb5 0x00 0x000000f9   jeq 249  true:0423 false:0242
 0242: 0x15 0xb4 0x00 0x000000fa   jeq 250  true:0423 false:0243
 0243: 0x15 0xb3 0x00 0x000000fc   jeq 252  true:0423 false:0244
 0244: 0x15 0xaf 0x00 0x000000fd   jeq 253  true:0420 false:0245
 0245: 0x15 0xb1 0x00 0x000000fe   jeq 254  true:0423 false:0246
 0246: 0x15 0xb0 0x00 0x000000ff   jeq 255  true:0423 false:0247
 0247: 0x15 0xaf 0x00 0x00000100   jeq 256  true:0423 false:0248
 0248: 0x15 0xae 0x00 0x00000101   jeq 257  true:0423 false:0249
 0249: 0x15 0xad 0x00 0x00000102   jeq 258  true:0423 false:0250
 0250: 0x15 0xac 0x00 0x00000103   jeq 259  true:0423 false:0251
 0251: 0x15 0xab 0x00 0x00000104   jeq 260  true:0423 false:0252
 0252: 0x15 0xaa 0x00 0x00000105   jeq 261  true:0423 false:0253
 0253: 0x15 0xa9 0x00 0x00000106   jeq 262  true:0423 false:0254
 0254: 0x15 0xa8 0x00 0x00000107   jeq 263  true:0423 false:0255
 0255: 0x15 0xa4 0x00 0x00000108   jeq 264  true:0420 false:0256
 0256: 0x15 0xa6 0x00 0x00000109   jeq 265  true:0423 false:0257
 0257: 0x15 0xa5 0x00 0x0000010a   jeq 266  true:0423 false:0258
 0258: 0x15 0xa4 0x00 0x0000010b   jeq 267  true:0423 false:0259
 0259: 0x15 0xa3 0x00 0x0000010c   jeq 268  true:0423 false:0260
 0260: 0x15 0xa2 0x00 0x0000010d   jeq 269  true:0423 false:0261
 0261: 0x15 0xa1 0x00 0x0000010e   jeq 270  true:0423 false:0262
 0262: 0x15 0xa0 0x00 0x0000010f   jeq 271  true:0423 false:0263
 0263: 0x15 0x9f 0x00 0x00000110   jeq 272  true:0423 false:0264
 0264: 0x15 0x9e 0x00 0x00000112   jeq 274  true:0423 false:0265
 0265: 0x15 0x9d 0x00 0x00000113   jeq 275  true:0423 false:0266
 0266: 0x15 0x9c 0x00 0x00000114   jeq 276  true:0423 false:0267
 0267: 0x15 0x9b 0x00 0x00000115   jeq 277  true:0423 false:0268
 0268: 0x15 0x9a 0x00 0x00000116   jeq 278  true:0423 false:0269
 0269: 0x15 0x99 0x00 0x00000117   jeq 279  true:0423 false:0270
 0270: 0x15 0x98 0x00 0x00000118   jeq 280  true:0423 false:0271
 0271: 0x15 0x97 0x00 0x00000119   jeq 281  true:0423 false:0272
 0272: 0x15 0x96 0x00 0x0000011a   jeq 282  true:0423 false:0273
 0273: 0x15 0x92 0x00 0x0000011b   jeq 283  true:0420 false:0274
 0274: 0x15 0x94 0x00 0x0000011c   jeq 284  true:0423 false:0275
 0275: 0x15 0x90 0x00 0x0000011e   jeq 286  true:0420 false:0276
 0276: 0x15 0x8f 0x00 0x0000011f   jeq 287  true:0420 false:0277
 0277: 0x15 0x8e 0x00 0x00000120   jeq 288  true:0420 false:0278
 0278: 0x15 0x90 0x00 0x00000121   jeq 289  true:0423 false:0279
 0279: 0x15 0x8f 0x00 0x00000122   jeq 290  true:0423 false:0280
 0280: 0x15 0x8e 0x00 0x00000123   jeq 291  true:0423 false:0281
 0281: 0x15 0x8d 0x00 0x00000124   jeq 292  true:0423 false:0282
 0282: 0x15 0x8c 0x00 0x00000125   jeq 293  true:0423 false:0283
 0283: 0x15 0x8b 0x00 0x00000126   jeq 294  true:0423 false:0284
 0284: 0x15 0x8a 0x00 0x00000127   jeq 295  true:0423 false:0285
 0285: 0x15 0x89 0x00 0x00000128   jeq 296  true:0423 false:0286
 0286: 0x15 0x88 0x00 0x00000129   jeq 297  true:0423 false:0287
 0287: 0x15 0x87 0x00 0x0000012a   jeq 298  true:0423 false:0288
 0288: 0x15 0x86 0x00 0x0000012b   jeq 299  true:0423 false:0289
 0289: 0x15 0x85 0x00 0x0000012c   jeq 300  true:0423 false:0290
 0290: 0x15 0x84 0x00 0x0000012d   jeq 301  true:0423 false:0291
 0291: 0x15 0x83 0x00 0x0000012e   jeq 302  true:0423 false:0292
 0292: 0x15 0x82 0x00 0x0000012f   jeq 303  true:0423 false:0293
 0293: 0x15 0x81 0x00 0x00000130   jeq 304  true:0423 false:0294
 0294: 0x15 0x80 0x00 0x00000131   jeq 305  true:0423 false:0295
 0295: 0x15 0x7f 0x00 0x00000132   jeq 306  true:0423 false:0296
 0296: 0x15 0x7e 0x00 0x00000133   jeq 307  true:0423 false:0297
 0297: 0x15 0x7d 0x00 0x00000134   jeq 308  true:0423 false:0298
 0298: 0x15 0x7c 0x00 0x00000135   jeq 309  true:0423 false:0299
 0299: 0x15 0x7b 0x00 0x00000136   jeq 310  true:0423 false:0300
 0300: 0x15 0x7a 0x00 0x00000137   jeq 311  true:0423 false:0301
 0301: 0x15 0x79 0x00 0x00000138   jeq 312  true:0423 false:0302
 0302: 0x15 0x78 0x00 0x00000139   jeq 313  true:0423 false:0303
 0303: 0x15 0x77 0x00 0x0000013a   jeq 314  true:0423 false:0304
 0304: 0x15 0x76 0x00 0x0000013b   jeq 315  true:0423 false:0305
 0305: 0x15 0x75 0x00 0x0000013c   jeq 316  true:0423 false:0306
 0306: 0x15 0x74 0x00 0x0000013d   jeq 317  true:0423 false:0307
 0307: 0x15 0x73 0x00 0x0000013e   jeq 318  true:0423 false:0308
 0308: 0x15 0x72 0x00 0x0000013f   jeq 319  true:0423 false:0309
 0309: 0x15 0x71 0x00 0x00000140   jeq 320  true:0423 false:0310
 0310: 0x15 0x70 0x00 0x00000141   jeq 321  true:0423 false:0311
 0311: 0x15 0x6f 0x00 0x00000142   jeq 322  true:0423 false:0312
 0312: 0x15 0x6e 0x00 0x00000143   jeq 323  true:0423 false:0313
 0313: 0x15 0x6d 0x00 0x00000144   jeq 324  true:0423 false:0314
 0314: 0x15 0x6c 0x00 0x00000145   jeq 325  true:0423 false:0315
 0315: 0x15 0x6b 0x00 0x00000146   jeq 326  true:0423 false:0316
 0316: 0x15 0x6a 0x00 0x00000147   jeq 327  true:0423 false:0317
 0317: 0x15 0x69 0x00 0x00000148   jeq 328  true:0423 false:0318
 0318: 0x15 0x68 0x00 0x00000149   jeq 329  true:0423 false:0319
 0319: 0x15 0x67 0x00 0x0000014a   jeq 330  true:0423 false:0320
 0320: 0x15 0x66 0x00 0x0000014b   jeq 331  true:0423 false:0321
 0321: 0x15 0x65 0x00 0x0000014c   jeq 332  true:0423 false:0322
 0322: 0x15 0x64 0x00 0x0000014d   jeq 333  true:0423 false:0323
 0323: 0x15 0x63 0x00 0x0000014e   jeq 334  true:0423 false:0324
 0324: 0x15 0x62 0x00 0x0000014f   jeq 335  true:0423 false:0325
 0325: 0x15 0x5e 0x00 0x00000150   jeq 336  true:0420 false:0326
 0326: 0x15 0x60 0x00 0x00000151   jeq 337  true:0423 false:0327
 0327: 0x15 0x5c 0x00 0x00000152   jeq 338  true:0420 false:0328
 0328: 0x15 0x5b 0x00 0x00000153   jeq 339  true:0420 false:0329
 0329: 0x15 0x5d 0x00 0x00000154   jeq 340  true:0423 false:0330
 0330: 0x15 0x5c 0x00 0x00000155   jeq 341  true:0423 false:0331
 0331: 0x15 0x58 0x00 0x00000156   jeq 342  true:0420 false:0332
 0332: 0x15 0x57 0x00 0x00000157   jeq 343  true:0420 false:0333
 0333: 0x15 0x59 0x00 0x00000158   jeq 344  true:0423 false:0334
 0334: 0x15 0x58 0x00 0x00000159   jeq 345  true:0423 false:0335
 0335: 0x15 0x57 0x00 0x0000015a   jeq 346  true:0423 false:0336
 0336: 0x15 0x56 0x00 0x0000015b   jeq 347  true:0423 false:0337
 0337: 0x15 0x55 0x00 0x0000015c   jeq 348  true:0423 false:0338
 0338: 0x15 0x54 0x00 0x0000015d   jeq 349  true:0423 false:0339
 0339: 0x15 0x50 0x00 0x0000015e   jeq 350  true:0420 false:0340
 0340: 0x15 0x52 0x00 0x0000015f   jeq 351  true:0423 false:0341
 0341: 0x15 0x51 0x00 0x00000160   jeq 352  true:0423 false:0342
 0342: 0x15 0x50 0x00 0x00000161   jeq 353  true:0423 false:0343
 0343: 0x15 0x4f 0x00 0x00000162   jeq 354  true:0423 false:0344
 0344: 0x15 0x4e 0x00 0x00000163   jeq 355  true:0423 false:0345
 0345: 0x15 0x4d 0x00 0x00000164   jeq 356  true:0423 false:0346
 0346: 0x15 0x49 0x00 0x00000165   jeq 357  true:0420 false:0347
 0347: 0x15 0x4b 0x00 0x00000166   jeq 358  true:0423 false:0348
 0348: 0x15 0x4a 0x00 0x00000167   jeq 359  true:0423 false:0349
 0349: 0x15 0x49 0x00 0x00000168   jeq 360  true:0423 false:0350
 0350: 0x15 0x48 0x00 0x00000169   jeq 361  true:0423 false:0351
 0351: 0x15 0x47 0x00 0x0000016a   jeq 362  true:0423 false:0352
 0352: 0x15 0x46 0x00 0x0000016b   jeq 363  true:0423 false:0353
 0353: 0x15 0x45 0x00 0x0000016c   jeq 364  true:0423 false:0354
 0354: 0x15 0x44 0x00 0x0000016d   jeq 365  true:0423 false:0355
 0355: 0x15 0x43 0x00 0x0000016e   jeq 366  true:0423 false:0356
 0356: 0x15 0x42 0x00 0x0000016f   jeq 367  true:0423 false:0357
 0357: 0x15 0x41 0x00 0x00000170   jeq 368  true:0423 false:0358
 0358: 0x15 0x40 0x00 0x00000171   jeq 369  true:0423 false:0359
 0359: 0x15 0x3f 0x00 0x00000172   jeq 370  true:0423 false:0360
 0360: 0x15 0x3e 0x00 0x00000173   jeq 371  true:0423 false:0361
 0361: 0x15 0x3d 0x00 0x00000174   jeq 372  true:0423 false:0362
 0362: 0x15 0x3c 0x00 0x00000175   jeq 373  true:0423 false:0363
 0363: 0x15 0x3b 0x00 0x00000176   jeq 374  true:0423 false:0364
 0364: 0x15 0x3a 0x00 0x00000177   jeq 375  true:0423 false:0365
 0365: 0x15 0x36 0x00 0x00000178   jeq 376  true:0420 false:0366
 0366: 0x15 0x38 0x00 0x00000179   jeq 377  true:0423 false:0367
 0367: 0x15 0x37 0x00 0x0000017a   jeq 378  true:0423 false:0368
 0368: 0x15 0x36 0x00 0x0000017b   jeq 379  true:0423 false:0369
 0369: 0x15 0x32 0x00 0x0000017c   jeq 380  true:0420 false:0370
 0370: 0x15 0x31 0x00 0x0000017d   jeq 381  true:0420 false:0371
 0371: 0x15 0x30 0x00 0x0000017e   jeq 382  true:0420 false:0372
 0372: 0x15 0x32 0x00 0x0000017f   jeq 383  true:0423 false:0373
 0373: 0x15 0x31 0x00 0x00000180   jeq 384  true:0423 false:0374
 0374: 0x15 0x30 0x00 0x00000181   jeq 385  true:0423 false:0375
 0375: 0x15 0x2f 0x00 0x00000182   jeq 386  true:0423 false:0376
 0376: 0x15 0x2e 0x00 0x00000189   jeq 393  true:0423 false:0377
 0377: 0x15 0x2d 0x00 0x0000018a   jeq 394  true:0423 false:0378
 0378: 0x15 0x2c 0x00 0x0000018b   jeq 395  true:0423 false:0379
 0379: 0x15 0x2b 0x00 0x0000018c   jeq 396  true:0423 false:0380
 0380: 0x15 0x2a 0x00 0x0000018d   jeq 397  true:0423 false:0381
 0381: 0x15 0x29 0x00 0x0000018e   jeq 398  true:0423 false:0382
 0382: 0x15 0x28 0x00 0x0000018f   jeq 399  true:0423 false:0383
 0383: 0x15 0x27 0x00 0x00000190   jeq 400  true:0423 false:0384
 0384: 0x15 0x26 0x00 0x00000191   jeq 401  true:0423 false:0385
 0385: 0x15 0x25 0x00 0x00000192   jeq 402  true:0423 false:0386
 0386: 0x15 0x24 0x00 0x00000193   jeq 403  true:0423 false:0387
 0387: 0x15 0x20 0x00 0x00000194   jeq 404  true:0420 false:0388
 0388: 0x15 0x1f 0x00 0x00000195   jeq 405  true:0420 false:0389
 0389: 0x15 0x21 0x00 0x00000196   jeq 406  true:0423 false:0390
 0390: 0x15 0x20 0x00 0x00000197   jeq 407  true:0423 false:0391
 0391: 0x15 0x1f 0x00 0x00000198   jeq 408  true:0423 false:0392
 0392: 0x15 0x1e 0x00 0x00000199   jeq 409  true:0423 false:0393
 0393: 0x15 0x1d 0x00 0x0000019a   jeq 410  true:0423 false:0394
 0394: 0x15 0x1c 0x00 0x0000019b   jeq 411  true:0423 false:0395
 0395: 0x15 0x1b 0x00 0x0000019c   jeq 412  true:0423 false:0396
 0396: 0x15 0x1a 0x00 0x0000019d   jeq 413  true:0423 false:0397
 0397: 0x15 0x19 0x00 0x0000019e   jeq 414  true:0423 false:0398
 0398: 0x15 0x18 0x00 0x000001a0   jeq 416  true:0423 false:0399
 0399: 0x15 0x17 0x00 0x000001a1   jeq 417  true:0423 false:0400
 0400: 0x15 0x16 0x00 0x000001a2   jeq 418  true:0423 false:0401
 0401: 0x15 0x15 0x00 0x000001a3   jeq 419  true:0423 false:0402
 0402: 0x15 0x14 0x00 0x000001a4   jeq 420  true:0423 false:0403
 0403: 0x15 0x13 0x00 0x000001a5   jeq 421  true:0423 false:0404
 0404: 0x15 0x12 0x00 0x000001a6   jeq 422  true:0423 false:0405
 0405: 0x15 0x0e 0x00 0x000001a7   jeq 423  true:0420 false:0406
 0406: 0x15 0x10 0x00 0x000001a8   jeq 424  true:0423 false:0407
 0407: 0x15 0x0f 0x00 0x000001a9   jeq 425  true:0423 false:0408
 0408: 0x15 0x0e 0x00 0x000001aa   jeq 426  true:0423 false:0409
 0409: 0x15 0x0d 0x00 0x000001ab   jeq 427  true:0423 false:0410
 0410: 0x15 0x0c 0x00 0x000001ac   jeq 428  true:0423 false:0411
 0411: 0x15 0x0b 0x00 0x000001ad   jeq 429  true:0423 false:0412
 0412: 0x15 0x0a 0x00 0x000001ae   jeq 430  true:0423 false:0413
 0413: 0x15 0x09 0x00 0x000001af   jeq 431  true:0423 false:0414
 0414: 0x15 0x08 0x00 0x000001b0   jeq 432  true:0423 false:0415
 0415: 0x15 0x07 0x00 0x000001b1   jeq 433  true:0423 false:0416
 0416: 0x15 0x06 0x00 0x000001b2   jeq 434  true:0423 false:0417
 0417: 0x15 0x05 0x00 0x000001b3   jeq 435  true:0423 false:0418
 0418: 0x15 0x04 0x00 0x000001b5   jeq 437  true:0423 false:0419
 0419: 0x15 0x00 0x01 0x000001b6   jeq 438  true:0420 false:0421
 0420: 0x06 0x00 0x00 0x00050001   ret ERRNO(1)
 0421: 0x15 0x01 0x00 0x000001b7   jeq 439  true:0423 false:0422
 0422: 0x06 0x00 0x00 0x00050026   ret ERRNO(38)
 0423: 0x06 0x00 0x00 0x7fff0000   ret ALLOW

With the optimization on:
 line  OP   JT   JF   K
=================================
 0000: 0x20 0x00 0x00 0x00000004   ld  $data[4]
 0001: 0x15 0x00 0x0d 0x40000003   jeq 1073741827 true:0002 false:0015
 0002: 0x20 0x00 0x00 0x00000000   ld  $data[0]
 0003: 0x25 0x01 0x00 0x000000a9   jgt 169  true:0005 false:0004
 0004: 0x05 0x00 0x00 0x00000143   jmp 0328
 0005: 0x25 0x00 0xa0 0x0000012f   jgt 303  true:0006 false:0166
 0006: 0x25 0x00 0x50 0x0000016f   jgt 367  true:0007 false:0087
 0007: 0x25 0x00 0x28 0x00000195   jgt 405  true:0008 false:0048
 0008: 0x25 0x00 0x14 0x000001a6   jgt 422  true:0009 false:0029
 0009: 0x25 0x00 0x0a 0x000001ae   jgt 430  true:0010 false:0020
 0010: 0x25 0x00 0x05 0x000001b2   jgt 434  true:0011 false:0016
 0011: 0x15 0x03 0x00 0x000001b7   jeq 439  true:0015 false:0012
 0012: 0x15 0xd9 0x00 0x000001b6   jeq 438  true:0230 false:0013
 0013: 0x15 0x01 0x00 0x000001b5   jeq 437  true:0015 false:0014
 0014: 0x15 0x00 0xfd 0x000001b3   jeq 435  true:0015 false:0268
 0015: 0x06 0x00 0x00 0x7fff0000   ret ALLOW
 0016: 0x15 0xff 0x00 0x000001b2   jeq 434  true:0272 false:0017
 0017: 0x15 0xfe 0x00 0x000001b1   jeq 433  true:0272 false:0018
 0018: 0x15 0xfd 0x00 0x000001b0   jeq 432  true:0272 false:0019
 0019: 0x15 0xfc 0xf8 0x000001af   jeq 431  true:0272 false:0268
 0020: 0x25 0x00 0x04 0x000001aa   jgt 426  true:0021 false:0025
 0021: 0x15 0xfa 0x00 0x000001ae   jeq 430  true:0272 false:0022
 0022: 0x15 0xf9 0x00 0x000001ad   jeq 429  true:0272 false:0023
 0023: 0x15 0xf8 0x00 0x000001ac   jeq 428  true:0272 false:0024
 0024: 0x15 0xf7 0xf3 0x000001ab   jeq 427  true:0272 false:0268
 0025: 0x15 0xf6 0x00 0x000001aa   jeq 426  true:0272 false:0026
 0026: 0x15 0xf5 0x00 0x000001a9   jeq 425  true:0272 false:0027
 0027: 0x15 0xf4 0x00 0x000001a8   jeq 424  true:0272 false:0028
 0028: 0x15 0xc9 0xef 0x000001a7   jeq 423  true:0230 false:0268
 0029: 0x25 0x00 0x09 0x0000019d   jgt 413  true:0030 false:0039
 0030: 0x25 0x00 0x04 0x000001a2   jgt 418  true:0031 false:0035
 0031: 0x15 0xf0 0x00 0x000001a6   jeq 422  true:0272 false:0032
 0032: 0x15 0xef 0x00 0x000001a5   jeq 421  true:0272 false:0033
 0033: 0x15 0xee 0x00 0x000001a4   jeq 420  true:0272 false:0034
 0034: 0x15 0xed 0xe9 0x000001a3   jeq 419  true:0272 false:0268
 0035: 0x15 0xec 0x00 0x000001a2   jeq 418  true:0272 false:0036
 0036: 0x15 0xeb 0x00 0x000001a1   jeq 417  true:0272 false:0037
 0037: 0x15 0xea 0x00 0x000001a0   jeq 416  true:0272 false:0038
 0038: 0x15 0xe9 0xe5 0x0000019e   jeq 414  true:0272 false:0268
 0039: 0x25 0x00 0x04 0x00000199   jgt 409  true:0040 false:0044
 0040: 0x15 0xe7 0x00 0x0000019d   jeq 413  true:0272 false:0041
 0041: 0x15 0xe6 0x00 0x0000019c   jeq 412  true:0272 false:0042
 0042: 0x15 0xe5 0x00 0x0000019b   jeq 411  true:0272 false:0043
 0043: 0x15 0xe4 0xe0 0x0000019a   jeq 410  true:0272 false:0268
 0044: 0x15 0xe3 0x00 0x00000199   jeq 409  true:0272 false:0045
 0045: 0x15 0xe2 0x00 0x00000198   jeq 408  true:0272 false:0046
 0046: 0x15 0xe1 0x00 0x00000197   jeq 407  true:0272 false:0047
 0047: 0x15 0xe0 0xdc 0x00000196   jeq 406  true:0272 false:0268
 0048: 0x25 0x00 0x13 0x0000017f   jgt 383  true:0049 false:0068
 0049: 0x25 0x00 0x09 0x0000018d   jgt 397  true:0050 false:0059
 0050: 0x25 0x00 0x04 0x00000191   jgt 401  true:0051 false:0055
 0051: 0x15 0xb2 0x00 0x00000195   jeq 405  true:0230 false:0052
 0052: 0x15 0xb1 0x00 0x00000194   jeq 404  true:0230 false:0053
 0053: 0x15 0xda 0x00 0x00000193   jeq 403  true:0272 false:0054
 0054: 0x15 0xd9 0xd5 0x00000192   jeq 402  true:0272 false:0268
 0055: 0x15 0xd8 0x00 0x00000191   jeq 401  true:0272 false:0056
 0056: 0x15 0xd7 0x00 0x00000190   jeq 400  true:0272 false:0057
 0057: 0x15 0xd6 0x00 0x0000018f   jeq 399  true:0272 false:0058
 0058: 0x15 0xd5 0xd1 0x0000018e   jeq 398  true:0272 false:0268
 0059: 0x25 0x00 0x04 0x00000189   jgt 393  true:0060 false:0064
 0060: 0x15 0xd3 0x00 0x0000018d   jeq 397  true:0272 false:0061
 0061: 0x15 0xd2 0x00 0x0000018c   jeq 396  true:0272 false:0062
 0062: 0x15 0xd1 0x00 0x0000018b   jeq 395  true:0272 false:0063
 0063: 0x15 0xd0 0xcc 0x0000018a   jeq 394  true:0272 false:0268
 0064: 0x15 0xcf 0x00 0x00000189   jeq 393  true:0272 false:0065
 0065: 0x15 0xce 0x00 0x00000182   jeq 386  true:0272 false:0066
 0066: 0x15 0xcd 0x00 0x00000181   jeq 385  true:0272 false:0067
 0067: 0x15 0xcc 0xc8 0x00000180   jeq 384  true:0272 false:0268
 0068: 0x25 0x00 0x09 0x00000177   jgt 375  true:0069 false:0078
 0069: 0x25 0x00 0x04 0x0000017b   jgt 379  true:0070 false:0074
 0070: 0x15 0xc9 0x00 0x0000017f   jeq 383  true:0272 false:0071
 0071: 0x15 0x9e 0x00 0x0000017e   jeq 382  true:0230 false:0072
 0072: 0x15 0x9d 0x00 0x0000017d   jeq 381  true:0230 false:0073
 0073: 0x15 0x9c 0xc2 0x0000017c   jeq 380  true:0230 false:0268
 0074: 0x15 0xc5 0x00 0x0000017b   jeq 379  true:0272 false:0075
 0075: 0x15 0xc4 0x00 0x0000017a   jeq 378  true:0272 false:0076
 0076: 0x15 0xc3 0x00 0x00000179   jeq 377  true:0272 false:0077
 0077: 0x15 0x98 0xbe 0x00000178   jeq 376  true:0230 false:0268
 0078: 0x25 0x00 0x04 0x00000173   jgt 371  true:0079 false:0083
 0079: 0x15 0xc0 0x00 0x00000177   jeq 375  true:0272 false:0080
 0080: 0x15 0xbf 0x00 0x00000176   jeq 374  true:0272 false:0081
 0081: 0x15 0xbe 0x00 0x00000175   jeq 373  true:0272 false:0082
 0082: 0x15 0xbd 0xb9 0x00000174   jeq 372  true:0272 false:0268
 0083: 0x15 0xbc 0x00 0x00000173   jeq 371  true:0272 false:0084
 0084: 0x15 0xbb 0x00 0x00000172   jeq 370  true:0272 false:0085
 0085: 0x15 0xba 0x00 0x00000171   jeq 369  true:0272 false:0086
 0086: 0x15 0xb9 0xb5 0x00000170   jeq 368  true:0272 false:0268
 0087: 0x25 0x00 0x27 0x0000014f   jgt 335  true:0088 false:0127
 0088: 0x25 0x00 0x13 0x0000015f   jgt 351  true:0089 false:0108
 0089: 0x25 0x00 0x09 0x00000167   jgt 359  true:0090 false:0099
 0090: 0x25 0x00 0x04 0x0000016b   jgt 363  true:0091 false:0095
 0091: 0x15 0xb4 0x00 0x0000016f   jeq 367  true:0272 false:0092
 0092: 0x15 0xb3 0x00 0x0000016e   jeq 366  true:0272 false:0093
 0093: 0x15 0xb2 0x00 0x0000016d   jeq 365  true:0272 false:0094
 0094: 0x15 0xb1 0xad 0x0000016c   jeq 364  true:0272 false:0268
 0095: 0x15 0xb0 0x00 0x0000016b   jeq 363  true:0272 false:0096
 0096: 0x15 0xaf 0x00 0x0000016a   jeq 362  true:0272 false:0097
 0097: 0x15 0xae 0x00 0x00000169   jeq 361  true:0272 false:0098
 0098: 0x15 0xad 0xa9 0x00000168   jeq 360  true:0272 false:0268
 0099: 0x25 0x00 0x04 0x00000163   jgt 355  true:0100 false:0104
 0100: 0x15 0xab 0x00 0x00000167   jeq 359  true:0272 false:0101
 0101: 0x15 0xaa 0x00 0x00000166   jeq 358  true:0272 false:0102
 0102: 0x15 0x7f 0x00 0x00000165   jeq 357  true:0230 false:0103
 0103: 0x15 0xa8 0xa4 0x00000164   jeq 356  true:0272 false:0268
 0104: 0x15 0xa7 0x00 0x00000163   jeq 355  true:0272 false:0105
 0105: 0x15 0xa6 0x00 0x00000162   jeq 354  true:0272 false:0106
 0106: 0x15 0xa5 0x00 0x00000161   jeq 353  true:0272 false:0107
 0107: 0x15 0xa4 0xa0 0x00000160   jeq 352  true:0272 false:0268
 0108: 0x25 0x00 0x09 0x00000157   jgt 343  true:0109 false:0118
 0109: 0x25 0x00 0x04 0x0000015b   jgt 347  true:0110 false:0114
 0110: 0x15 0xa1 0x00 0x0000015f   jeq 351  true:0272 false:0111
 0111: 0x15 0x76 0x00 0x0000015e   jeq 350  true:0230 false:0112
 0112: 0x15 0x9f 0x00 0x0000015d   jeq 349  true:0272 false:0113
 0113: 0x15 0x9e 0x9a 0x0000015c   jeq 348  true:0272 false:0268
 0114: 0x15 0x9d 0x00 0x0000015b   jeq 347  true:0272 false:0115
 0115: 0x15 0x9c 0x00 0x0000015a   jeq 346  true:0272 false:0116
 0116: 0x15 0x9b 0x00 0x00000159   jeq 345  true:0272 false:0117
 0117: 0x15 0x9a 0x96 0x00000158   jeq 344  true:0272 false:0268
 0118: 0x25 0x00 0x04 0x00000153   jgt 339  true:0119 false:0123
 0119: 0x15 0x6e 0x00 0x00000157   jeq 343  true:0230 false:0120
 0120: 0x15 0x6d 0x00 0x00000156   jeq 342  true:0230 false:0121
 0121: 0x15 0x96 0x00 0x00000155   jeq 341  true:0272 false:0122
 0122: 0x15 0x95 0x91 0x00000154   jeq 340  true:0272 false:0268
 0123: 0x15 0x6a 0x00 0x00000153   jeq 339  true:0230 false:0124
 0124: 0x15 0x69 0x00 0x00000152   jeq 338  true:0230 false:0125
 0125: 0x15 0x92 0x00 0x00000151   jeq 337  true:0272 false:0126
 0126: 0x15 0x67 0x8d 0x00000150   jeq 336  true:0230 false:0268
 0127: 0x25 0x00 0x13 0x0000013f   jgt 319  true:0128 false:0147
 0128: 0x25 0x00 0x09 0x00000147   jgt 327  true:0129 false:0138
 0129: 0x25 0x00 0x04 0x0000014b   jgt 331  true:0130 false:0134
 0130: 0x15 0x8d 0x00 0x0000014f   jeq 335  true:0272 false:0131
 0131: 0x15 0x8c 0x00 0x0000014e   jeq 334  true:0272 false:0132
 0132: 0x15 0x8b 0x00 0x0000014d   jeq 333  true:0272 false:0133
 0133: 0x15 0x8a 0x86 0x0000014c   jeq 332  true:0272 false:0268
 0134: 0x15 0x89 0x00 0x0000014b   jeq 331  true:0272 false:0135
 0135: 0x15 0x88 0x00 0x0000014a   jeq 330  true:0272 false:0136
 0136: 0x15 0x87 0x00 0x00000149   jeq 329  true:0272 false:0137
 0137: 0x15 0x86 0x82 0x00000148   jeq 328  true:0272 false:0268
 0138: 0x25 0x00 0x04 0x00000143   jgt 323  true:0139 false:0143
 0139: 0x15 0x84 0x00 0x00000147   jeq 327  true:0272 false:0140
 0140: 0x15 0x83 0x00 0x00000146   jeq 326  true:0272 false:0141
 0141: 0x15 0x82 0x00 0x00000145   jeq 325  true:0272 false:0142
 0142: 0x15 0x81 0x7d 0x00000144   jeq 324  true:0272 false:0268
 0143: 0x15 0x80 0x00 0x00000143   jeq 323  true:0272 false:0144
 0144: 0x15 0x7f 0x00 0x00000142   jeq 322  true:0272 false:0145
 0145: 0x15 0x7e 0x00 0x00000141   jeq 321  true:0272 false:0146
 0146: 0x15 0x7d 0x79 0x00000140   jeq 320  true:0272 false:0268
 0147: 0x25 0x00 0x09 0x00000137   jgt 311  true:0148 false:0157
 0148: 0x25 0x00 0x04 0x0000013b   jgt 315  true:0149 false:0153
 0149: 0x15 0x7a 0x00 0x0000013f   jeq 319  true:0272 false:0150
 0150: 0x15 0x79 0x00 0x0000013e   jeq 318  true:0272 false:0151
 0151: 0x15 0x78 0x00 0x0000013d   jeq 317  true:0272 false:0152
 0152: 0x15 0x77 0x73 0x0000013c   jeq 316  true:0272 false:0268
 0153: 0x15 0x76 0x00 0x0000013b   jeq 315  true:0272 false:0154
 0154: 0x15 0x75 0x00 0x0000013a   jeq 314  true:0272 false:0155
 0155: 0x15 0x74 0x00 0x00000139   jeq 313  true:0272 false:0156
 0156: 0x15 0x73 0x6f 0x00000138   jeq 312  true:0272 false:0268
 0157: 0x25 0x00 0x04 0x00000133   jgt 307  true:0158 false:0162
 0158: 0x15 0x71 0x00 0x00000137   jeq 311  true:0272 false:0159
 0159: 0x15 0x70 0x00 0x00000136   jeq 310  true:0272 false:0160
 0160: 0x15 0x6f 0x00 0x00000135   jeq 309  true:0272 false:0161
 0161: 0x15 0x6e 0x6a 0x00000134   jeq 308  true:0272 false:0268
 0162: 0x15 0x6d 0x00 0x00000133   jeq 307  true:0272 false:0163
 0163: 0x15 0x6c 0x00 0x00000132   jeq 306  true:0272 false:0164
 0164: 0x15 0x6b 0x00 0x00000131   jeq 305  true:0272 false:0165
 0165: 0x15 0x6a 0x66 0x00000130   jeq 304  true:0272 false:0268
 0166: 0x25 0x00 0x50 0x000000ec   jgt 236  true:0167 false:0247
 0167: 0x25 0x00 0x27 0x0000010d   jgt 269  true:0168 false:0207
 0168: 0x25 0x00 0x13 0x0000011f   jgt 287  true:0169 false:0188
 0169: 0x25 0x00 0x09 0x00000127   jgt 295  true:0170 false:0179
 0170: 0x25 0x00 0x04 0x0000012b   jgt 299  true:0171 false:0175
 0171: 0x15 0x64 0x00 0x0000012f   jeq 303  true:0272 false:0172
 0172: 0x15 0x63 0x00 0x0000012e   jeq 302  true:0272 false:0173
 0173: 0x15 0x62 0x00 0x0000012d   jeq 301  true:0272 false:0174
 0174: 0x15 0x61 0x5d 0x0000012c   jeq 300  true:0272 false:0268
 0175: 0x15 0x60 0x00 0x0000012b   jeq 299  true:0272 false:0176
 0176: 0x15 0x5f 0x00 0x0000012a   jeq 298  true:0272 false:0177
 0177: 0x15 0x5e 0x00 0x00000129   jeq 297  true:0272 false:0178
 0178: 0x15 0x5d 0x59 0x00000128   jeq 296  true:0272 false:0268
 0179: 0x25 0x00 0x04 0x00000123   jgt 291  true:0180 false:0184
 0180: 0x15 0x5b 0x00 0x00000127   jeq 295  true:0272 false:0181
 0181: 0x15 0x5a 0x00 0x00000126   jeq 294  true:0272 false:0182
 0182: 0x15 0x59 0x00 0x00000125   jeq 293  true:0272 false:0183
 0183: 0x15 0x58 0x54 0x00000124   jeq 292  true:0272 false:0268
 0184: 0x15 0x57 0x00 0x00000123   jeq 291  true:0272 false:0185
 0185: 0x15 0x56 0x00 0x00000122   jeq 290  true:0272 false:0186
 0186: 0x15 0x55 0x00 0x00000121   jeq 289  true:0272 false:0187
 0187: 0x15 0x2a 0x50 0x00000120   jeq 288  true:0230 false:0268
 0188: 0x25 0x00 0x09 0x00000116   jgt 278  true:0189 false:0198
 0189: 0x25 0x00 0x04 0x0000011a   jgt 282  true:0190 false:0194
 0190: 0x15 0x27 0x00 0x0000011f   jeq 287  true:0230 false:0191
 0191: 0x15 0x26 0x00 0x0000011e   jeq 286  true:0230 false:0192
 0192: 0x15 0x4f 0x00 0x0000011c   jeq 284  true:0272 false:0193
 0193: 0x15 0x24 0x4a 0x0000011b   jeq 283  true:0230 false:0268
 0194: 0x15 0x4d 0x00 0x0000011a   jeq 282  true:0272 false:0195
 0195: 0x15 0x4c 0x00 0x00000119   jeq 281  true:0272 false:0196
 0196: 0x15 0x4b 0x00 0x00000118   jeq 280  true:0272 false:0197
 0197: 0x15 0x4a 0x46 0x00000117   jeq 279  true:0272 false:0268
 0198: 0x25 0x00 0x04 0x00000112   jgt 274  true:0199 false:0203
 0199: 0x15 0x48 0x00 0x00000116   jeq 278  true:0272 false:0200
 0200: 0x15 0x47 0x00 0x00000115   jeq 277  true:0272 false:0201
 0201: 0x15 0x46 0x00 0x00000114   jeq 276  true:0272 false:0202
 0202: 0x15 0x45 0x41 0x00000113   jeq 275  true:0272 false:0268
 0203: 0x15 0x44 0x00 0x00000112   jeq 274  true:0272 false:0204
 0204: 0x15 0x43 0x00 0x00000110   jeq 272  true:0272 false:0205
 0205: 0x15 0x42 0x00 0x0000010f   jeq 271  true:0272 false:0206
 0206: 0x15 0x41 0x3d 0x0000010e   jeq 270  true:0272 false:0268
 0207: 0x25 0x00 0x13 0x000000fd   jgt 253  true:0208 false:0227
 0208: 0x25 0x00 0x09 0x00000105   jgt 261  true:0209 false:0218
 0209: 0x25 0x00 0x04 0x00000109   jgt 265  true:0210 false:0214
 0210: 0x15 0x3d 0x00 0x0000010d   jeq 269  true:0272 false:0211
 0211: 0x15 0x3c 0x00 0x0000010c   jeq 268  true:0272 false:0212
 0212: 0x15 0x3b 0x00 0x0000010b   jeq 267  true:0272 false:0213
 0213: 0x15 0x3a 0x36 0x0000010a   jeq 266  true:0272 false:0268
 0214: 0x15 0x39 0x00 0x00000109   jeq 265  true:0272 false:0215
 0215: 0x15 0x0e 0x00 0x00000108   jeq 264  true:0230 false:0216
 0216: 0x15 0x37 0x00 0x00000107   jeq 263  true:0272 false:0217
 0217: 0x15 0x36 0x32 0x00000106   jeq 262  true:0272 false:0268
 0218: 0x25 0x00 0x04 0x00000101   jgt 257  true:0219 false:0223
 0219: 0x15 0x34 0x00 0x00000105   jeq 261  true:0272 false:0220
 0220: 0x15 0x33 0x00 0x00000104   jeq 260  true:0272 false:0221
 0221: 0x15 0x32 0x00 0x00000103   jeq 259  true:0272 false:0222
 0222: 0x15 0x31 0x2d 0x00000102   jeq 258  true:0272 false:0268
 0223: 0x15 0x30 0x00 0x00000101   jeq 257  true:0272 false:0224
 0224: 0x15 0x2f 0x00 0x00000100   jeq 256  true:0272 false:0225
 0225: 0x15 0x2e 0x00 0x000000ff   jeq 255  true:0272 false:0226
 0226: 0x15 0x2d 0x29 0x000000fe   jeq 254  true:0272 false:0268
 0227: 0x25 0x00 0x0a 0x000000f4   jgt 244  true:0228 false:0238
 0228: 0x25 0x00 0x05 0x000000f8   jgt 248  true:0229 false:0234
 0229: 0x15 0x00 0x01 0x000000fd   jeq 253  true:0230 false:0231
 0230: 0x06 0x00 0x00 0x00050001   ret ERRNO(1)
 0231: 0x15 0x28 0x00 0x000000fc   jeq 252  true:0272 false:0232
 0232: 0x15 0x27 0x00 0x000000fa   jeq 250  true:0272 false:0233
 0233: 0x15 0x26 0x22 0x000000f9   jeq 249  true:0272 false:0268
 0234: 0x15 0x25 0x00 0x000000f8   jeq 248  true:0272 false:0235
 0235: 0x15 0x24 0x00 0x000000f7   jeq 247  true:0272 false:0236
 0236: 0x15 0x23 0x00 0x000000f6   jeq 246  true:0272 false:0237
 0237: 0x15 0x22 0x1e 0x000000f5   jeq 245  true:0272 false:0268
 0238: 0x25 0x00 0x04 0x000000f0   jgt 240  true:0239 false:0243
 0239: 0x15 0x20 0x00 0x000000f4   jeq 244  true:0272 false:0240
 0240: 0x15 0x1f 0x00 0x000000f3   jeq 243  true:0272 false:0241
 0241: 0x15 0x1e 0x00 0x000000f2   jeq 242  true:0272 false:0242
 0242: 0x15 0x1d 0x19 0x000000f1   jeq 241  true:0272 false:0268
 0243: 0x15 0x1c 0x00 0x000000f0   jeq 240  true:0272 false:0244
 0244: 0x15 0x1b 0x00 0x000000ef   jeq 239  true:0272 false:0245
 0245: 0x15 0x1a 0x00 0x000000ee   jeq 238  true:0272 false:0246
 0246: 0x15 0x19 0x15 0x000000ed   jeq 237  true:0272 false:0268
 0247: 0x25 0x00 0x29 0x000000ca   jgt 202  true:0248 false:0289
 0248: 0x25 0x00 0x14 0x000000da   jgt 218  true:0249 false:0269
 0249: 0x25 0x00 0x09 0x000000e4   jgt 228  true:0250 false:0259
 0250: 0x25 0x00 0x04 0x000000e8   jgt 232  true:0251 false:0255
 0251: 0x15 0x14 0x00 0x000000ec   jeq 236  true:0272 false:0252
 0252: 0x15 0x13 0x00 0x000000eb   jeq 235  true:0272 false:0253
 0253: 0x15 0x12 0x00 0x000000ea   jeq 234  true:0272 false:0254
 0254: 0x15 0x11 0x0d 0x000000e9   jeq 233  true:0272 false:0268
 0255: 0x15 0x10 0x00 0x000000e8   jeq 232  true:0272 false:0256
 0256: 0x15 0x0f 0x00 0x000000e7   jeq 231  true:0272 false:0257
 0257: 0x15 0x0e 0x00 0x000000e6   jeq 230  true:0272 false:0258
 0258: 0x15 0x0d 0x09 0x000000e5   jeq 229  true:0272 false:0268
 0259: 0x25 0x00 0x04 0x000000e0   jgt 224  true:0260 false:0264
 0260: 0x15 0x0b 0x00 0x000000e4   jeq 228  true:0272 false:0261
 0261: 0x15 0x0a 0x00 0x000000e3   jeq 227  true:0272 false:0262
 0262: 0x15 0x09 0x00 0x000000e2   jeq 226  true:0272 false:0263
 0263: 0x15 0x08 0x04 0x000000e1   jeq 225  true:0272 false:0268
 0264: 0x15 0x07 0x00 0x000000e0   jeq 224  true:0272 false:0265
 0265: 0x15 0x06 0x00 0x000000dd   jeq 221  true:0272 false:0266
 0266: 0x15 0x05 0x00 0x000000dc   jeq 220  true:0272 false:0267
 0267: 0x15 0x04 0x00 0x000000db   jeq 219  true:0272 false:0268
 0268: 0x06 0x00 0x00 0x00050026   ret ERRNO(38)
 0269: 0x25 0x00 0x0a 0x000000d2   jgt 210  true:0270 false:0280
 0270: 0x25 0x00 0x05 0x000000d6   jgt 214  true:0271 false:0276
 0271: 0x15 0x00 0x01 0x000000da   jeq 218  true:0272 false:0273
 0272: 0x06 0x00 0x00 0x7fff0000   ret ALLOW
 0273: 0x15 0xff 0x00 0x000000d9   jeq 217  true:0529 false:0274
 0274: 0x15 0xfe 0x00 0x000000d8   jeq 216  true:0529 false:0275
 0275: 0x15 0xfd 0xfc 0x000000d7   jeq 215  true:0529 false:0528
 0276: 0x15 0xfc 0x00 0x000000d6   jeq 214  true:0529 false:0277
 0277: 0x15 0xfb 0x00 0x000000d5   jeq 213  true:0529 false:0278
 0278: 0x15 0xfa 0x00 0x000000d4   jeq 212  true:0529 false:0279
 0279: 0x15 0xf9 0xf8 0x000000d3   jeq 211  true:0529 false:0528
 0280: 0x25 0x00 0x04 0x000000ce   jgt 206  true:0281 false:0285
 0281: 0x15 0xf7 0x00 0x000000d2   jeq 210  true:0529 false:0282
 0282: 0x15 0xf6 0x00 0x000000d1   jeq 209  true:0529 false:0283
 0283: 0x15 0xf5 0x00 0x000000d0   jeq 208  true:0529 false:0284
 0284: 0x15 0xf4 0xf3 0x000000cf   jeq 207  true:0529 false:0528
 0285: 0x15 0xf3 0x00 0x000000ce   jeq 206  true:0529 false:0286
 0286: 0x15 0xf2 0x00 0x000000cd   jeq 205  true:0529 false:0287
 0287: 0x15 0xf1 0x00 0x000000cc   jeq 204  true:0529 false:0288
 0288: 0x15 0xf0 0xef 0x000000cb   jeq 203  true:0529 false:0528
 0289: 0x25 0x00 0x13 0x000000b9   jgt 185  true:0290 false:0309
 0290: 0x25 0x00 0x09 0x000000c2   jgt 194  true:0291 false:0300
 0291: 0x25 0x00 0x04 0x000000c6   jgt 198  true:0292 false:0296
 0292: 0x15 0xec 0x00 0x000000ca   jeq 202  true:0529 false:0293
 0293: 0x15 0xeb 0x00 0x000000c9   jeq 201  true:0529 false:0294
 0294: 0x15 0xea 0x00 0x000000c8   jeq 200  true:0529 false:0295
 0295: 0x15 0xe9 0xe8 0x000000c7   jeq 199  true:0529 false:0528
 0296: 0x15 0xe8 0x00 0x000000c6   jeq 198  true:0529 false:0297
 0297: 0x15 0xe7 0x00 0x000000c5   jeq 197  true:0529 false:0298
 0298: 0x15 0xe6 0x00 0x000000c4   jeq 196  true:0529 false:0299
 0299: 0x15 0xe5 0xe4 0x000000c3   jeq 195  true:0529 false:0528
 0300: 0x25 0x00 0x04 0x000000be   jgt 190  true:0301 false:0305
 0301: 0x15 0xe3 0x00 0x000000c2   jeq 194  true:0529 false:0302
 0302: 0x15 0xe2 0x00 0x000000c1   jeq 193  true:0529 false:0303
 0303: 0x15 0xe1 0x00 0x000000c0   jeq 192  true:0529 false:0304
 0304: 0x15 0xe0 0xdf 0x000000bf   jeq 191  true:0529 false:0528
 0305: 0x15 0xdf 0x00 0x000000be   jeq 190  true:0529 false:0306
 0306: 0x15 0xc0 0x00 0x000000bc   jeq 188  true:0499 false:0307
 0307: 0x15 0xdd 0x00 0x000000bb   jeq 187  true:0529 false:0308
 0308: 0x15 0xdc 0xdb 0x000000ba   jeq 186  true:0529 false:0528
 0309: 0x25 0x00 0x09 0x000000b1   jgt 177  true:0310 false:0319
 0310: 0x25 0x00 0x04 0x000000b5   jgt 181  true:0311 false:0315
 0311: 0x15 0xd9 0x00 0x000000b9   jeq 185  true:0529 false:0312
 0312: 0x15 0xd8 0x00 0x000000b8   jeq 184  true:0529 false:0313
 0313: 0x15 0xd7 0x00 0x000000b7   jeq 183  true:0529 false:0314
 0314: 0x15 0xd6 0xd5 0x000000b6   jeq 182  true:0529 false:0528
 0315: 0x15 0xd5 0x00 0x000000b5   jeq 181  true:0529 false:0316
 0316: 0x15 0xd4 0x00 0x000000b4   jeq 180  true:0529 false:0317
 0317: 0x15 0xd3 0x00 0x000000b3   jeq 179  true:0529 false:0318
 0318: 0x15 0xd2 0xd1 0x000000b2   jeq 178  true:0529 false:0528
 0319: 0x25 0x00 0x04 0x000000ad   jgt 173  true:0320 false:0324
 0320: 0x15 0xd0 0x00 0x000000b1   jeq 177  true:0529 false:0321
 0321: 0x15 0xcf 0x00 0x000000b0   jeq 176  true:0529 false:0322
 0322: 0x15 0xce 0x00 0x000000af   jeq 175  true:0529 false:0323
 0323: 0x15 0xcd 0xcc 0x000000ae   jeq 174  true:0529 false:0528
 0324: 0x15 0xcc 0x00 0x000000ad   jeq 173  true:0529 false:0325
 0325: 0x15 0xcb 0x00 0x000000ac   jeq 172  true:0529 false:0326
 0326: 0x15 0xca 0x00 0x000000ab   jeq 171  true:0529 false:0327
 0327: 0x15 0xc9 0xc8 0x000000aa   jeq 170  true:0529 false:0528
 0328: 0x25 0x00 0x9f 0x00000022   jgt 34   true:0329 false:0488
 0329: 0x25 0x00 0x4f 0x00000068   jgt 104  true:0330 false:0409
 0330: 0x25 0x00 0x27 0x00000088   jgt 136  true:0331 false:0370
 0331: 0x25 0x00 0x13 0x00000099   jgt 153  true:0332 false:0351
 0332: 0x25 0x00 0x09 0x000000a1   jgt 161  true:0333 false:0342
 0333: 0x25 0x00 0x04 0x000000a5   jgt 165  true:0334 false:0338
 0334: 0x15 0xa4 0x00 0x000000a9   jeq 169  true:0499 false:0335
 0335: 0x15 0xc1 0x00 0x000000a8   jeq 168  true:0529 false:0336
 0336: 0x15 0xa2 0x00 0x000000a7   jeq 167  true:0499 false:0337
 0337: 0x15 0xa1 0xbe 0x000000a6   jeq 166  true:0499 false:0528
 0338: 0x15 0xbe 0x00 0x000000a5   jeq 165  true:0529 false:0339
 0339: 0x15 0xbd 0x00 0x000000a4   jeq 164  true:0529 false:0340
 0340: 0x15 0xbc 0x00 0x000000a3   jeq 163  true:0529 false:0341
 0341: 0x15 0xbb 0xba 0x000000a2   jeq 162  true:0529 false:0528
 0342: 0x25 0x00 0x04 0x0000009d   jgt 157  true:0343 false:0347
 0343: 0x15 0xb9 0x00 0x000000a1   jeq 161  true:0529 false:0344
 0344: 0x15 0xb8 0x00 0x000000a0   jeq 160  true:0529 false:0345
 0345: 0x15 0xb7 0x00 0x0000009f   jeq 159  true:0529 false:0346
 0346: 0x15 0xb6 0xb5 0x0000009e   jeq 158  true:0529 false:0528
 0347: 0x15 0xb5 0x00 0x0000009d   jeq 157  true:0529 false:0348
 0348: 0x15 0xb4 0x00 0x0000009c   jeq 156  true:0529 false:0349
 0349: 0x15 0xb3 0x00 0x0000009b   jeq 155  true:0529 false:0350
 0350: 0x15 0xb2 0xb1 0x0000009a   jeq 154  true:0529 false:0528
 0351: 0x25 0x00 0x09 0x00000091   jgt 145  true:0352 false:0361
 0352: 0x25 0x00 0x04 0x00000095   jgt 149  true:0353 false:0357
 0353: 0x15 0x91 0x00 0x00000099   jeq 153  true:0499 false:0354
 0354: 0x15 0x90 0x00 0x00000098   jeq 152  true:0499 false:0355
 0355: 0x15 0x8f 0x00 0x00000097   jeq 151  true:0499 false:0356
 0356: 0x15 0x8e 0xab 0x00000096   jeq 150  true:0499 false:0528
 0357: 0x15 0x8d 0x00 0x00000095   jeq 149  true:0499 false:0358
 0358: 0x15 0xaa 0x00 0x00000094   jeq 148  true:0529 false:0359
 0359: 0x15 0xa9 0x00 0x00000093   jeq 147  true:0529 false:0360
 0360: 0x15 0xa8 0xa7 0x00000092   jeq 146  true:0529 false:0528
 0361: 0x25 0x00 0x04 0x0000008d   jgt 141  true:0362 false:0366
 0362: 0x15 0xa6 0x00 0x00000091   jeq 145  true:0529 false:0363
 0363: 0x15 0xa5 0x00 0x00000090   jeq 144  true:0529 false:0364
 0364: 0x15 0xa4 0x00 0x0000008f   jeq 143  true:0529 false:0365
 0365: 0x15 0xa3 0xa2 0x0000008e   jeq 142  true:0529 false:0528
 0366: 0x15 0xa2 0x00 0x0000008d   jeq 141  true:0529 false:0367
 0367: 0x15 0xa1 0x00 0x0000008c   jeq 140  true:0529 false:0368
 0368: 0x15 0xa0 0x00 0x0000008b   jeq 139  true:0529 false:0369
 0369: 0x15 0x9f 0x9e 0x0000008a   jeq 138  true:0529 false:0528
 0370: 0x25 0x00 0x13 0x00000078   jgt 120  true:0371 false:0390
 0371: 0x25 0x00 0x09 0x00000080   jgt 128  true:0372 false:0381
 0372: 0x25 0x00 0x04 0x00000084   jgt 132  true:0373 false:0377
 0373: 0x15 0x9b 0x00 0x00000088   jeq 136  true:0529 false:0374
 0374: 0x15 0x7c 0x00 0x00000087   jeq 135  true:0499 false:0375
 0375: 0x15 0x7b 0x00 0x00000086   jeq 134  true:0499 false:0376
 0376: 0x15 0x98 0x97 0x00000085   jeq 133  true:0529 false:0528
 0377: 0x15 0x97 0x00 0x00000084   jeq 132  true:0529 false:0378
 0378: 0x15 0x78 0x00 0x00000083   jeq 131  true:0499 false:0379
 0379: 0x15 0x77 0x00 0x00000082   jeq 130  true:0499 false:0380
 0380: 0x15 0x76 0x93 0x00000081   jeq 129  true:0499 false:0528
 0381: 0x25 0x00 0x04 0x0000007c   jgt 124  true:0382 false:0386
 0382: 0x15 0x74 0x00 0x00000080   jeq 128  true:0499 false:0383
 0383: 0x15 0x73 0x00 0x0000007f   jeq 127  true:0499 false:0384
 0384: 0x15 0x90 0x00 0x0000007e   jeq 126  true:0529 false:0385
 0385: 0x15 0x8f 0x8e 0x0000007d   jeq 125  true:0529 false:0528
 0386: 0x15 0x70 0x00 0x0000007c   jeq 124  true:0499 false:0387
 0387: 0x15 0x6f 0x00 0x0000007b   jeq 123  true:0499 false:0388
 0388: 0x15 0x8c 0x00 0x0000007a   jeq 122  true:0529 false:0389
 0389: 0x15 0x8b 0x8a 0x00000079   jeq 121  true:0529 false:0528
 0390: 0x25 0x00 0x09 0x00000070   jgt 112  true:0391 false:0400
 0391: 0x25 0x00 0x04 0x00000074   jgt 116  true:0392 false:0396
 0392: 0x15 0x88 0x00 0x00000078   jeq 120  true:0529 false:0393
 0393: 0x15 0x87 0x00 0x00000077   jeq 119  true:0529 false:0394
 0394: 0x15 0x86 0x00 0x00000076   jeq 118  true:0529 false:0395
 0395: 0x15 0x85 0x84 0x00000075   jeq 117  true:0529 false:0528
 0396: 0x15 0x84 0x00 0x00000074   jeq 116  true:0529 false:0397
 0397: 0x15 0x65 0x00 0x00000073   jeq 115  true:0499 false:0398
 0398: 0x15 0x82 0x00 0x00000072   jeq 114  true:0529 false:0399
 0399: 0x15 0x63 0x80 0x00000071   jeq 113  true:0499 false:0528
 0400: 0x25 0x00 0x04 0x0000006c   jgt 108  true:0401 false:0405
 0401: 0x15 0x61 0x00 0x00000070   jeq 112  true:0499 false:0402
 0402: 0x15 0x7e 0x00 0x0000006f   jeq 111  true:0529 false:0403
 0403: 0x15 0x5f 0x00 0x0000006e   jeq 110  true:0499 false:0404
 0404: 0x15 0x7c 0x7b 0x0000006d   jeq 109  true:0529 false:0528
 0405: 0x15 0x7b 0x00 0x0000006c   jeq 108  true:0529 false:0406
 0406: 0x15 0x7a 0x00 0x0000006b   jeq 107  true:0529 false:0407
 0407: 0x15 0x79 0x00 0x0000006a   jeq 106  true:0529 false:0408
 0408: 0x15 0x78 0x77 0x00000069   jeq 105  true:0529 false:0528
 0409: 0x25 0x00 0x27 0x00000047   jgt 71   true:0410 false:0449
 0410: 0x25 0x00 0x13 0x00000057   jgt 87   true:0411 false:0430
 0411: 0x25 0x00 0x09 0x0000005f   jgt 95   true:0412 false:0421
 0412: 0x25 0x00 0x04 0x00000064   jgt 100  true:0413 false:0417
 0413: 0x15 0x73 0x00 0x00000068   jeq 104  true:0529 false:0414
 0414: 0x15 0x54 0x00 0x00000067   jeq 103  true:0499 false:0415
 0415: 0x15 0x71 0x00 0x00000066   jeq 102  true:0529 false:0416
 0416: 0x15 0x52 0x6f 0x00000065   jeq 101  true:0499 false:0528
 0417: 0x15 0x6f 0x00 0x00000064   jeq 100  true:0529 false:0418
 0418: 0x15 0x6e 0x00 0x00000063   jeq 99   true:0529 false:0419
 0419: 0x15 0x6d 0x00 0x00000061   jeq 97   true:0529 false:0420
 0420: 0x15 0x6c 0x6b 0x00000060   jeq 96   true:0529 false:0528
 0421: 0x25 0x00 0x04 0x0000005b   jgt 91   true:0422 false:0426
 0422: 0x15 0x6a 0x00 0x0000005f   jeq 95   true:0529 false:0423
 0423: 0x15 0x69 0x00 0x0000005e   jeq 94   true:0529 false:0424
 0424: 0x15 0x68 0x00 0x0000005d   jeq 93   true:0529 false:0425
 0425: 0x15 0x67 0x66 0x0000005c   jeq 92   true:0529 false:0528
 0426: 0x15 0x66 0x00 0x0000005b   jeq 91   true:0529 false:0427
 0427: 0x15 0x65 0x00 0x0000005a   jeq 90   true:0529 false:0428
 0428: 0x15 0x64 0x00 0x00000059   jeq 89   true:0529 false:0429
 0429: 0x15 0x63 0x62 0x00000058   jeq 88   true:0529 false:0528
 0430: 0x25 0x00 0x09 0x0000004f   jgt 79   true:0431 false:0440
 0431: 0x25 0x00 0x04 0x00000053   jgt 83   true:0432 false:0436
 0432: 0x15 0x42 0x00 0x00000057   jeq 87   true:0499 false:0433
 0433: 0x15 0x41 0x00 0x00000056   jeq 86   true:0499 false:0434
 0434: 0x15 0x5e 0x00 0x00000055   jeq 85   true:0529 false:0435
 0435: 0x15 0x5d 0x5c 0x00000054   jeq 84   true:0529 false:0528
 0436: 0x15 0x5c 0x00 0x00000053   jeq 83   true:0529 false:0437
 0437: 0x15 0x5b 0x00 0x00000052   jeq 82   true:0529 false:0438
 0438: 0x15 0x5a 0x00 0x00000051   jeq 81   true:0529 false:0439
 0439: 0x15 0x59 0x58 0x00000050   jeq 80   true:0529 false:0528
 0440: 0x25 0x00 0x04 0x0000004b   jgt 75   true:0441 false:0445
 0441: 0x15 0x39 0x00 0x0000004f   jeq 79   true:0499 false:0442
 0442: 0x15 0x56 0x00 0x0000004e   jeq 78   true:0529 false:0443
 0443: 0x15 0x55 0x00 0x0000004d   jeq 77   true:0529 false:0444
 0444: 0x15 0x54 0x53 0x0000004c   jeq 76   true:0529 false:0528
 0445: 0x15 0x53 0x00 0x0000004b   jeq 75   true:0529 false:0446
 0446: 0x15 0x52 0x00 0x0000004a   jeq 74   true:0529 false:0447
 0447: 0x15 0x51 0x00 0x00000049   jeq 73   true:0529 false:0448
 0448: 0x15 0x50 0x4f 0x00000048   jeq 72   true:0529 false:0528
 0449: 0x25 0x00 0x13 0x00000034   jgt 52   true:0450 false:0469
 0450: 0x25 0x00 0x09 0x0000003f   jgt 63   true:0451 false:0460
 0451: 0x25 0x00 0x04 0x00000043   jgt 67   true:0452 false:0456
 0452: 0x15 0x4c 0x00 0x00000047   jeq 71   true:0529 false:0453
 0453: 0x15 0x4b 0x00 0x00000046   jeq 70   true:0529 false:0454
 0454: 0x15 0x2c 0x00 0x00000045   jeq 69   true:0499 false:0455
 0455: 0x15 0x2b 0x48 0x00000044   jeq 68   true:0499 false:0528
 0456: 0x15 0x48 0x00 0x00000043   jeq 67   true:0529 false:0457
 0457: 0x15 0x47 0x00 0x00000042   jeq 66   true:0529 false:0458
 0458: 0x15 0x46 0x00 0x00000041   jeq 65   true:0529 false:0459
 0459: 0x15 0x45 0x44 0x00000040   jeq 64   true:0529 false:0528
 0460: 0x25 0x00 0x04 0x0000003b   jgt 59   true:0461 false:0465
 0461: 0x15 0x43 0x00 0x0000003f   jeq 63   true:0529 false:0462
 0462: 0x15 0x24 0x00 0x0000003e   jeq 62   true:0499 false:0463
 0463: 0x15 0x41 0x00 0x0000003d   jeq 61   true:0529 false:0464
 0464: 0x15 0x40 0x3f 0x0000003c   jeq 60   true:0529 false:0528
 0465: 0x15 0x3f 0x00 0x0000003b   jeq 59   true:0529 false:0466
 0466: 0x15 0x3e 0x00 0x00000039   jeq 57   true:0529 false:0467
 0467: 0x15 0x3d 0x00 0x00000037   jeq 55   true:0529 false:0468
 0468: 0x15 0x3c 0x3b 0x00000036   jeq 54   true:0529 false:0528
 0469: 0x25 0x00 0x09 0x0000002b   jgt 43   true:0470 false:0479
 0470: 0x25 0x00 0x04 0x00000030   jgt 48   true:0471 false:0475
 0471: 0x15 0x39 0x00 0x00000034   jeq 52   true:0529 false:0472
 0472: 0x15 0x1a 0x00 0x00000033   jeq 51   true:0499 false:0473
 0473: 0x15 0x37 0x00 0x00000032   jeq 50   true:0529 false:0474
 0474: 0x15 0x36 0x35 0x00000031   jeq 49   true:0529 false:0528
 0475: 0x15 0x35 0x00 0x00000030   jeq 48   true:0529 false:0476
 0476: 0x15 0x34 0x00 0x0000002f   jeq 47   true:0529 false:0477
 0477: 0x15 0x33 0x00 0x0000002e   jeq 46   true:0529 false:0478
 0478: 0x15 0x32 0x31 0x0000002d   jeq 45   true:0529 false:0528
 0479: 0x25 0x00 0x04 0x00000027   jgt 39   true:0480 false:0484
 0480: 0x15 0x30 0x00 0x0000002b   jeq 43   true:0529 false:0481
 0481: 0x15 0x2f 0x00 0x0000002a   jeq 42   true:0529 false:0482
 0482: 0x15 0x2e 0x00 0x00000029   jeq 41   true:0529 false:0483
 0483: 0x15 0x2d 0x2c 0x00000028   jeq 40   true:0529 false:0528
 0484: 0x15 0x2c 0x00 0x00000027   jeq 39   true:0529 false:0485
 0485: 0x15 0x2b 0x00 0x00000026   jeq 38   true:0529 false:0486
 0486: 0x15 0x2a 0x00 0x00000025   jeq 37   true:0529 false:0487
 0487: 0x15 0x29 0x28 0x00000024   jeq 36   true:0529 false:0528
 0488: 0x25 0x00 0x14 0x0000000f   jgt 15   true:0489 false:0509
 0489: 0x25 0x00 0x0a 0x00000018   jgt 24   true:0490 false:0500
 0490: 0x25 0x00 0x04 0x0000001c   jgt 28   true:0491 false:0495
 0491: 0x15 0x25 0x00 0x00000022   jeq 34   true:0529 false:0492
 0492: 0x15 0x24 0x00 0x00000021   jeq 33   true:0529 false:0493
 0493: 0x15 0x23 0x00 0x0000001e   jeq 30   true:0529 false:0494
 0494: 0x15 0x22 0x21 0x0000001d   jeq 29   true:0529 false:0528
 0495: 0x15 0x21 0x00 0x0000001c   jeq 28   true:0529 false:0496
 0496: 0x15 0x20 0x00 0x0000001b   jeq 27   true:0529 false:0497
 0497: 0x15 0x1f 0x00 0x0000001a   jeq 26   true:0529 false:0498
 0498: 0x15 0x00 0x1d 0x00000019   jeq 25   true:0499 false:0528
 0499: 0x06 0x00 0x00 0x00050001   ret ERRNO(1)
 0500: 0x25 0x00 0x04 0x00000014   jgt 20   true:0501 false:0505
 0501: 0x15 0x1b 0x00 0x00000018   jeq 24   true:0529 false:0502
 0502: 0x15 0x1a 0x00 0x00000017   jeq 23   true:0529 false:0503
 0503: 0x15 0x19 0x00 0x00000016   jeq 22   true:0529 false:0504
 0504: 0x15 0x18 0x17 0x00000015   jeq 21   true:0529 false:0528
 0505: 0x15 0x17 0x00 0x00000014   jeq 20   true:0529 false:0506
 0506: 0x15 0x16 0x00 0x00000013   jeq 19   true:0529 false:0507
 0507: 0x15 0x15 0x00 0x00000012   jeq 18   true:0529 false:0508
 0508: 0x15 0x14 0x13 0x00000010   jeq 16   true:0529 false:0528
 0509: 0x25 0x00 0x09 0x00000007   jgt 7    true:0510 false:0519
 0510: 0x25 0x00 0x04 0x0000000b   jgt 11   true:0511 false:0515
 0511: 0x15 0x11 0x00 0x0000000f   jeq 15   true:0529 false:0512
 0512: 0x15 0x10 0x00 0x0000000e   jeq 14   true:0529 false:0513
 0513: 0x15 0x0f 0x00 0x0000000d   jeq 13   true:0529 false:0514
 0514: 0x15 0x0e 0x0d 0x0000000c   jeq 12   true:0529 false:0528
 0515: 0x15 0x0d 0x00 0x0000000b   jeq 11   true:0529 false:0516
 0516: 0x15 0x0c 0x00 0x0000000a   jeq 10   true:0529 false:0517
 0517: 0x15 0x0b 0x00 0x00000009   jeq 9    true:0529 false:0518
 0518: 0x15 0x0a 0x09 0x00000008   jeq 8    true:0529 false:0528
 0519: 0x25 0x00 0x04 0x00000003   jgt 3    true:0520 false:0524
 0520: 0x15 0x08 0x00 0x00000007   jeq 7    true:0529 false:0521
 0521: 0x15 0x07 0x00 0x00000006   jeq 6    true:0529 false:0522
 0522: 0x15 0x06 0x00 0x00000005   jeq 5    true:0529 false:0523
 0523: 0x15 0x05 0x04 0x00000004   jeq 4    true:0529 false:0528
 0524: 0x15 0x04 0x00 0x00000003   jeq 3    true:0529 false:0525
 0525: 0x15 0x03 0x00 0x00000002   jeq 2    true:0529 false:0526
 0526: 0x15 0x02 0x00 0x00000001   jeq 1    true:0529 false:0527
 0527: 0x15 0x01 0x00 0x00000000   jeq 0    true:0529 false:0528
 0528: 0x06 0x00 0x00 0x00050026   ret ERRNO(38)
 0529: 0x06 0x00 0x00 0x7fff0000   ret ALLOW

Sizes: 2952, 3392, 4240 bytes.
Addition of @known results only in a small growth. "Optimization" makes the
filter longer, but it should run more quickly. We probably want to enable this
everywhere. There is clear potential futher optmization though.
2020-08-24 20:05:25 +02:00
Zbigniew Jędrzejewski-Szmek 3573e032f2 nspawn: return ENOSYS by default, EPERM for "known" calls 2020-08-24 20:05:17 +02:00
Zbigniew Jędrzejewski-Szmek 000c05207d shared/seccomp-util: added functionality to make list of filtred syscalls
While at it, start removing the "seccomp_" prefix from our
own functions. It is used by libseccomp.
2020-08-24 20:05:09 +02:00
Aurelien Jarno f9252236c8 seccomp: add support for riscv64
This patch adds seccomp support to the riscv64 architecture. seccomp
support is available in the riscv64 kernel since version 5.5, and it
has just been added to the libseccomp library.

riscv64 uses generic syscalls like aarch64, so I used that architecture
as a reference to find which code has to be modified.

With this patch, the testsuite passes successfully, including the
test-seccomp test. The system boots and works fine with kernel 5.4 (i.e.
without seccomp support) and kernel 5.5 (i.e. with seccomp support). I
have also verified that the "SystemCallFilter=~socket" option prevents a
service to use the ping utility when running on kernel 5.5.
2020-08-21 10:10:29 +02:00
Lennart Poettering 5b14956385
Merge pull request #16543 from poettering/nspawn-run-host
nspawn: /run/host/ tweaks
2020-08-20 16:20:05 +02:00
Lennart Poettering 0f48ba7b84 nspawn: provide $container and $container_uuid in /run/host too
This has the major benefit that the entire payload of the container can
access these files there. Previously, we'd set them only as env vars,
but that meant only PID 1 could read them directly or other privileged
payload code with access to /run/1/environ.
2020-08-20 10:17:55 +02:00
Lennart Poettering 9fac502920 nspawn,pid1: pass "inaccessible" nodes from cntr mgr to pid1 payload via /run/host
Let's make /run/host the sole place we pass stuff from host to container
in and place the "inaccessible" nodes in /run/host too.

In contrast to the previous two commits this is a minor compat break, but
not a relevant one I think. Previously the container manager would place
these nodes in /run/systemd/inaccessible/ and that's where PID 1 in the
container would try to add them too when missing. Container manager and
PID 1 in the container would thus manage the same dir together.

With this change the container manager now passes an immutable directory
to the container and leaves /run/systemd entirely untouched, and managed
exclusively by PID 1 inside the container, which is nice to have clear
separation on who manages what.

In order to make sure systemd then usses the /run/host/inaccesible/
nodes this commit changes PID 1 to look for that dir and if it exists
will symlink it to /run/systemd/inaccessible.

Now, this will work fine if new nspawn and new pid 1 in the container
work together. as then the symlink is created and the difference between
the two dirs won't matter.

For the case where an old nspawn invokes a new PID 1: in this case
things work as they always worked: the dir is managed together.

For the case where different container manager invokes a new PID 1: in
this case the nodes aren't typically passed in, and PID 1 in the
container will try to create them and will likely fail partially (though
gracefully) when trying to create char/block device nodes. THis is fine
though as there are fallbacks in place for that case.

For the case where a new nspawn invokes an old PID1: this is were the
(minor) incompatibily happens: in this case new nspawn will place the
nodes in the /run/host/inaccessible/ subdir, but the PID 1 in the
container won't look for them there. Since the nodes are also not
pre-created in /run/systed/inaccessible/ PID 1 will try to create them
there as if a different container manager sets them up. This is of
course not sexy, but is not a total loss, since as mentioned fallbacks
are in place anyway. Hence I think it's OK to accept this minor
incompatibility.
2020-08-20 10:17:52 +02:00
Lennart Poettering e96ceabac9 nspawn: move $NOTIFY_SOCKET into /run/host/ too
The sd_notify() socket that nspawn binds that the payload can use to
talk to it was previously stored in /run/systemd/nspawn/notify, which is
weird (as in the previous commit) since this makes /run/systemd
something that is cooperatively maintained by systemd inside the
container and nspawn outside of it.

We now have a better place where container managers can put the stuff
they want to pass to the payload: /run/host/, hence let's make use of
that.

This is not a compat breakage, since the sd_notify() protocol is based
on the $NOTIFY_SOCKET env var, where we place the new socket path.
2020-08-20 10:17:48 +02:00
Lennart Poettering 5a27b39518 nspawn/machine: move mount propagation dir to /run/host/incoming
Previously we'd use a directory /run/systemd/nspawn/incoming for
accepting mounts to propagate from the host. This is a bit weird, since
we have a shared namespace: /run/systemd/ contains both stuff managed by
the surround nspawn as well as from the systemd inside.

We now have the /run/host/ hierarchy that has special stuff we want to
pass from host to container. Let's make use of that here, and move this
directory here too.

This is not a compat breakage, since the payload never interfaces with
that directory natively: it's only nspawn and machined that need to
agree on it.
2020-08-20 10:17:25 +02:00
Zbigniew Jędrzejewski-Szmek b4eaa6cc99 shared/seccomp: use _cleanup_ in one more place
(cherry picked from commit 27605d6a836d85563faf41db9f7a72883d44c0ff)
2020-08-19 10:57:30 +02:00
Lennart Poettering af187ab237 dissect: introduce new helper dissected_image_mount_and_warn() and use it everywhere 2020-08-11 22:26:48 +02:00
Zbigniew Jędrzejewski-Szmek 7e62257219
Merge pull request #16308 from bluca/root_image_options
service: add new RootImageOptions feature
2020-08-03 10:04:36 +02:00
Daan De Meyer 6f646e0175 nspawn: Fix incorrect usage of putenv
strv_env_get only returns the environment variable value. putenv expects
KEY=VALUE format strings. Use setenv instead to fix the use.
2020-08-03 09:58:05 +02:00
Zbigniew Jędrzejewski-Szmek b67ec8e5b2 pid1: stop limiting size of /dev/shm
The explicit limit is dropped, which means that we return to the kernel default
of 50% of RAM. See 362a55fc14 for a discussion why that is not as much as it
seems. It turns out various applications need more space in /dev/shm and we
would break them by imposing a low limit.

While at it, rename the define and use a single macro for various tmpfs mounts.
We don't really care what the purpose of the given tmpfs is, so it seems
reasonable to use a single macro.

This effectively reverts part of 7d85383edb. Fixes #16617.
2020-07-30 18:48:35 +02:00
Luca Boccassi 18d7370587 service: add new RootImageOptions feature
Allows to specify mount options for RootImage.
In case of multi-partition images, the partition number can be prefixed
followed by colon. Eg:

RootImageOptions=1:ro,dev 2:nosuid nodev

In absence of a partition number, 0 is assumed.
2020-07-29 17:17:32 +01:00
Lennart Poettering d64e32c245 nspawn: rework how /run/host/ is set up
Let's find the right os-release file on the host side, and only mount
the one that matters, i.e. /etc/os-release if it exists and
/usr/lib/os-release otherwise. Use the fixed path /run/host/os-release
for that.

Let's also mount /run/host as a bind mount on itself before we set up
/run/host, and let's mount it MS_RDONLY after we are done, so that it
remains immutable as a whole.
2020-07-23 18:47:38 +02:00