From 8f048bb76a350473fb81a4a100aa5aafa7d3f824 Mon Sep 17 00:00:00 2001 From: Daan De Meyer Date: Tue, 15 Mar 2022 17:12:06 +0000 Subject: [PATCH 1/2] bpf: Log at debug when checking if restricting ifaces is supported Same change as 1a9e33aee36b4c353628068507ba1dd7d76b6e14 did for socket-bind. --- src/core/restrict-ifaces.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/src/core/restrict-ifaces.c b/src/core/restrict-ifaces.c index 0132c3c877..00dc429078 100644 --- a/src/core/restrict-ifaces.c +++ b/src/core/restrict-ifaces.c @@ -34,11 +34,12 @@ static int prepare_restrict_ifaces_bpf( obj = restrict_ifaces_bpf__open(); if (!obj) - return log_unit_error_errno(u, SYNTHETIC_ERRNO(ENOMEM), "Failed to open BPF object"); + return log_unit_full_errno(u, u ? LOG_ERR : LOG_DEBUG, + SYNTHETIC_ERRNO(ENOMEM), "Failed to open BPF object"); r = sym_bpf_map__resize(obj->maps.sd_restrictif, MAX(set_size(restrict_network_interfaces), 1u)); if (r != 0) - return log_unit_error_errno(u, r, + return log_unit_full_errno(u, u ? LOG_ERR : LOG_WARNING, r, "Failed to resize BPF map '%s': %m", sym_bpf_map__name(obj->maps.sd_restrictif)); @@ -46,7 +47,7 @@ static int prepare_restrict_ifaces_bpf( r = restrict_ifaces_bpf__load(obj); if (r != 0) - return log_unit_error_errno(u, r, "Failed to load BPF object: %m"); + return log_unit_full_errno(u, u ? LOG_ERR : LOG_DEBUG, r, "Failed to load BPF object: %m"); map_fd = sym_bpf_map__fd(obj->maps.sd_restrictif); @@ -61,7 +62,9 @@ static int prepare_restrict_ifaces_bpf( } if (sym_bpf_map_update_elem(map_fd, &ifindex, &dummy, BPF_ANY)) - return log_unit_error_errno(u, errno, "Failed to update BPF map '%s' fd: %m", sym_bpf_map__name(obj->maps.sd_restrictif)); + return log_unit_full_errno(u, u ? LOG_ERR : LOG_WARNING, errno, + "Failed to update BPF map '%s' fd: %m", + sym_bpf_map__name(obj->maps.sd_restrictif)); } *ret_object = TAKE_PTR(obj); From cc20479f422d0b10556c2636ae60f7c9483094f8 Mon Sep 17 00:00:00 2001 From: Daan De Meyer Date: Tue, 15 Mar 2022 17:14:19 +0000 Subject: [PATCH 2/2] bpf: Fix error handling The __open() functions actually set errno on failure so let's update the error handling to account for that. --- src/core/bpf-socket-bind.c | 3 +-- src/core/restrict-ifaces.c | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/src/core/bpf-socket-bind.c b/src/core/bpf-socket-bind.c index c5176aa481..806df84ea7 100644 --- a/src/core/bpf-socket-bind.c +++ b/src/core/bpf-socket-bind.c @@ -78,8 +78,7 @@ static int prepare_socket_bind_bpf( obj = socket_bind_bpf__open(); if (!obj) - return log_unit_full_errno(u, u ? LOG_ERR : LOG_DEBUG, SYNTHETIC_ERRNO(ENOMEM), - "Failed to open BPF object"); + return log_unit_full_errno(u, u ? LOG_ERR : LOG_DEBUG, errno, "Failed to open BPF object: %m"); if (sym_bpf_map__resize(obj->maps.sd_bind_allow, MAX(allow_count, 1u)) != 0) return log_unit_full_errno(u, u ? LOG_ERR : LOG_WARNING, errno, diff --git a/src/core/restrict-ifaces.c b/src/core/restrict-ifaces.c index 00dc429078..efa5c8d85a 100644 --- a/src/core/restrict-ifaces.c +++ b/src/core/restrict-ifaces.c @@ -34,8 +34,7 @@ static int prepare_restrict_ifaces_bpf( obj = restrict_ifaces_bpf__open(); if (!obj) - return log_unit_full_errno(u, u ? LOG_ERR : LOG_DEBUG, - SYNTHETIC_ERRNO(ENOMEM), "Failed to open BPF object"); + return log_unit_full_errno(u, u ? LOG_ERR : LOG_DEBUG, errno, "Failed to open BPF object: %m"); r = sym_bpf_map__resize(obj->maps.sd_restrictif, MAX(set_size(restrict_network_interfaces), 1u)); if (r != 0)