SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

nspawn,shared: cleanup use of ERRNO_IS_SECCOMP_FATAL()

Browse Source 
Given that ERRNO_IS_SECCOMP_FATAL() also matches positive values,
make sure this macro is not called with arguments that do not have
errno semantics.

In this case the arguments passed to ERRNO_IS_SECCOMP_FATAL() are the
values returned by external libseccomp function seccomp_load() which is
not expected to return any positive values, but let's be consistent
anyway and move ERRNO_IS_SECCOMP_FATAL() invocations to the branches
where the return values are known to be negative.
This commit is contained in:
Dmitry V. Levin
2023-07-28 12:28:35 +00:00
parent 0d16fab986
commit 5cfc190520
3 changed files with 64 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/nspawn/nspawn-seccomp.c
+8 -6
View File
@@ -206,10 +206,11 @@ int setup_seccomp(uint64_t cap_list_retain, char **syscall_allow_list, char **sy
return r;
r = seccomp_load(seccomp);
if (ERRNO_IS_SECCOMP_FATAL(r))
return log_error_errno(r, "Failed to install seccomp filter: %m");
if (r < 0)
if (r < 0) {
if (ERRNO_IS_SECCOMP_FATAL(r))
return log_error_errno(r, "Failed to install seccomp filter: %m");
log_debug_errno(r, "Failed to install filter set for architecture %s, skipping: %m", seccomp_arch_to_string(arch));
}
}
SECCOMP_FOREACH_LOCAL_ARCH(arch) {
@@ -242,10 +243,11 @@ int setup_seccomp(uint64_t cap_list_retain, char **syscall_allow_list, char **sy
}
r = seccomp_load(seccomp);
if (ERRNO_IS_SECCOMP_FATAL(r))
return log_error_errno(r, "Failed to install seccomp audit filter: %m");
if (r < 0)
if (r < 0) {
if (ERRNO_IS_SECCOMP_FATAL(r))
return log_error_errno(r, "Failed to install seccomp audit filter: %m");
log_debug_errno(r, "Failed to install filter set for architecture %s, skipping: %m", seccomp_arch_to_string(arch));
}
}
return 0;
src/nspawn/nspawn.c
+4 -3
View File
@@ -3412,10 +3412,11 @@ static int inner_child(
if (is_seccomp_available()) {
r = seccomp_load(arg_seccomp);
if (ERRNO_IS_SECCOMP_FATAL(r))
return log_error_errno(r, "Failed to install seccomp filter: %m");
if (r < 0)
if (r < 0) {
if (ERRNO_IS_SECCOMP_FATAL(r))
return log_error_errno(r, "Failed to install seccomp filter: %m");
log_debug_errno(r, "Failed to install seccomp filter: %m");
}
}
} else
#endif