diff options
| author | Lennart Poettering <lennart@poettering.net> | 2017-10-05 11:24:51 +0200 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2017-10-05 11:27:34 +0200 |
| commit | 1c6af69b2d25af90e210bc21cc378fb4a6c96316 (patch) | |
| tree | 001e8d7494ec2892d5ee520897617e5119d56903 /src | |
| parent | ff217dc3afe95504e48aeb8d8ad7fb7f53ce9cb1 (diff) | |
| download | systemd-1c6af69b2d25af90e210bc21cc378fb4a6c96316.tar.gz | |
seccomp: always handle seccomp_load() failing the same way
Unfortunately libseccomp doesn't return (nor document) clean error
codes, hence until then only check for specific error codes that we
propagate, but ignore (but debug log) all others. Do this at one more
place, we are already doing that at all others.
Diffstat (limited to 'src')
| -rw-r--r-- | src/shared/seccomp-util.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c index 64ea86a677..a3728ff7b2 100644 --- a/src/shared/seccomp-util.c +++ b/src/shared/seccomp-util.c @@ -1187,7 +1187,6 @@ int seccomp_restrict_address_families(Set *address_families, bool whitelist) { if (r < 0) break; } - if (r < 0) { log_debug_errno(r, "Failed to add socket() rule for architecture %s, skipping: %m", seccomp_arch_to_string(arch)); continue; @@ -1212,7 +1211,6 @@ int seccomp_restrict_address_families(Set *address_families, bool whitelist) { if (r < 0) break; } - if (r < 0) { log_debug_errno(r, "Failed to add socket() rule for architecture %s, skipping: %m", seccomp_arch_to_string(arch)); continue; @@ -1453,7 +1451,13 @@ int seccomp_restrict_archs(Set *archs) { if (r < 0) return r; - return seccomp_load(seccomp); + r = seccomp_load(seccomp); + if (IN_SET(r, -EPERM, -EACCES)) + return r; + if (r < 0) + log_debug_errno(r, "Failed to restrict system call architectures, skipping: %m"); + + return 0; } int parse_syscall_archs(char **l, Set **archs) { |