api: limit errno values to MAX_ERRNO

It turns out that userspace behaves oddly when given an errno value
greater than MAX_ERRNO, so much so that the kernel seccomp mechanism
has started blocking filters with bad errno values.  Let's try to
catch the problem at rule addition time to make things easier to
spot and fix.

Signed-off-by: Paul Moore <pmoore@redhat.com>

1 files changed, 6 insertions, 0 deletions

diff --git a/tests/11-basic-basic_errors.py b/tests/11-basic-basic_errors.py
index 10e5d7d..915c241 100755
--- a/tests/11-basic-basic_errors.py
+++ b/tests/11-basic-basic_errors.py
@@ -81,6 +81,12 @@ def test():
     except RuntimeError:
         pass
 
+    f = SyscallFilter(ALLOW)
+    try:
+        f.add_rule(ERRNO(0xffff), "read")
+    except RuntimeError:
+        pass
+
 test()
 
 # kate: syntax python;