diff options
| author | Colin Walters <walters@verbum.org> | 2016-05-06 09:20:41 -0400 |
|---|---|---|
| committer | Colin Walters (automation) <walters+githubbot@verbum.org> | 2016-05-06 13:41:55 +0000 |
| commit | cbbdaaab13d3b7ee289d0fbc1538362a418a9916 (patch) | |
| tree | ead34441c74256c399c19fac7733a4af5e5209eb | |
| parent | a91f6a7469fbdf03d502e96443aa43db424c5f49 (diff) | |
| download | bubblewrap-cbbdaaab13d3b7ee289d0fbc1538362a418a9916.tar.gz | |
Add error handling for eventfd() and prctl(PR_SET_SECCOMP)
It's likely possible for callers to use `ulimit()` to cause us to
fail `eventfd()` with `EMFILE` - we should handle that.
If a caller requests seccomp but for some reason we fail to install
it, we shouldn't silently continue.
Closes: #52
Approved by: rhatdan
| -rw-r--r-- | bubblewrap.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/bubblewrap.c b/bubblewrap.c index 83edd33..160b215 100644 --- a/bubblewrap.c +++ b/bubblewrap.c @@ -1248,7 +1248,11 @@ main (int argc, __debug__(("creating new namespace\n")); if (opt_unshare_pid) - event_fd = eventfd (0, EFD_CLOEXEC | EFD_NONBLOCK); + { + event_fd = eventfd (0, EFD_CLOEXEC | EFD_NONBLOCK); + if (event_fd == -1) + die_with_error ("eventfd()"); + } /* We block sigchild here so that we can use signalfd in the monitor. */ block_sigchild (); @@ -1444,7 +1448,8 @@ main (int argc, close (opt_seccomp_fd); - prctl (PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); + if (prctl (PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) != 0) + die_with_error ("prctl(PR_SET_SECCOMP)"); } umask (old_umask); |