db: fix a 64bit filter DB problem
db: fix a 64bit filter DB problem

Fix a problem when generating 64bit filters where the individual nodes
were overly connected, making some of the optimizations ineffective.
This fix should result in smaller filters on 64bit systems that use
syscall argument filtering.

The examples below were taken from the 08-subtree-checks test.

Before this patch (incorrect):

 # filter code for syscall #1006 (priority: 65529)
  if ($syscall != 1006) goto syscal_1006_end;
  if ($a1.hi32 == 0)
   if ($a1.lo32 == 1)
    if ($a2.hi32 == 0)
     if ($a2.lo32 == 2)
      action ALLOW;
   else
    action ALLOW;
  else
   if ($a2.hi32 == 0)
    if ($a2.lo32 == 0)
     action ALLOW;
  syscall_1006_end:

After this patch (correct):

 # filter code for syscall #1006 (priority: 65531)
  if ($syscall != 1006) goto syscal_1006_end;
  if ($a1.hi32 == 0)
   if ($a1.lo32 == 1)
    if ($a2.hi32 == 0)
     if ($a2.lo32 == 2)
      action ALLOW;
   else
    action ALLOW;
  syscall_1006_end:

Signed-off-by: Paul Moore <88a1d58bf22a647dce58dd91f9595600dceabba9@redhat.com>

seccomp/libseccomp,seccomp/libseccomp,amluto/libseccomp,amluto/libseccomp,seccomp/libseccomp,amluto/libseccomp