# --- T2-COPYRIGHT-BEGIN ---
# t2/package/*/systemd/hotfix-seccomp-x32.patch
# Copyright (C) 2026 The T2 SDE Project
# SPDX-License-Identifier: GPL-2.0 or patched project license
# --- T2-COPYRIGHT-END ---

--- systemd-261.2/src/shared/seccomp-util.c.vanilla
+++ systemd-261.2/src/shared/seccomp-util.c
@@ -2054,9 +2054,11 @@ int seccomp_restrict_archs(Set *archs) {
                 /* The vdso for x32 assumes that x86-64 syscalls are available.  Let's allow them, since x32
                  * x32 syscalls should basically match x86-64 for everything except the pointer type.
                  * The important thing is that you can block the old 32-bit x86 syscalls.
-                 * https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850047 */
+                 * https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850047
+                 * On an x32 host "native" resolves to SCMP_ARCH_NATIVE, so accept that spelling too. */
                 if (block && arch == SCMP_ARCH_X86_64 && sym_seccomp_arch_native() == SCMP_ARCH_X32)
-                        block = !set_contains(archs, UINT32_TO_PTR(SCMP_ARCH_X32 + 1));
+                        block = !set_contains(archs, UINT32_TO_PTR(SCMP_ARCH_X32 + 1)) &&
+                                !set_contains(archs, UINT32_TO_PTR(SCMP_ARCH_NATIVE + 1));
 
                 if (block) {
                         seccomp_local_archs[i] = SECCOMP_LOCAL_ARCH_BLOCKED;