From: Lennart Poettering <lennart@poettering.net>
Date: Thu, 5 Oct 2017 09:26:09 +0000 (+0200)
Subject: seccomp: ignore (and debug log) errors by all invocations of seccomp_rule_add_exact()
X-Git-Tag: v235~15^2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=448ac526a3fc95c4b4bfa24fe25ea95a88127c49;p=thirdparty%2Fsystemd.git

seccomp: ignore (and debug log) errors by all invocations of seccomp_rule_add_exact()

System calls might exist on some archs but not on others, or might be
multiplexed but not on others. Ignore such errors when putting together
a filter at this location like we already do it on all others.
---

diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c
index a3728ff7b2f..73dc571b6bb 100644
--- a/src/shared/seccomp-util.c
+++ b/src/shared/seccomp-util.c
@@ -1549,8 +1549,10 @@ int seccomp_lock_personality(unsigned long personality) {
                                 SCMP_SYS(personality),
                                 1,
                                 SCMP_A0(SCMP_CMP_NE, personality));
-                if (r < 0)
-                        return r;
+                if (r < 0) {
+                        log_debug_errno(r, "Failed to add scheduler rule for architecture %s, skipping: %m", seccomp_arch_to_string(arch));
+                        continue;
+                }
 
                 r = seccomp_load(seccomp);
                 if (IN_SET(r, -EPERM, -EACCES))