From: Lucas Werkmeister <mail@lucaswerkmeister.de>
Date: Sat, 25 Aug 2018 22:27:29 +0000 (+0200)
Subject: seccomp: improve error reporting
X-Git-Tag: v240~748^2~1
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=851ee70a3da1263a8eb9e7f230d2e18462ec2ead;p=thirdparty%2Fsystemd.git

seccomp: improve error reporting

Only report OOM if that was actually the error of the operation,
explicitly report the possible error that a syscall was already blocked
with a different errno and translate that into a more sensible errno
(EEXIST only makes sense in connection to the hashmap), and pass through
all other potential errors unmodified. Part of #9939.
---

diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c
index ade3c656af6..5072ceb2d10 100644
--- a/src/shared/seccomp-util.c
+++ b/src/shared/seccomp-util.c
@@ -1057,7 +1057,17 @@ int seccomp_parse_syscall_filter_full(
                 if (!(flags & SECCOMP_PARSE_INVERT) == !!(flags & SECCOMP_PARSE_WHITELIST)) {
                         r = hashmap_put(filter, INT_TO_PTR(id + 1), INT_TO_PTR(errno_num));
                         if (r < 0)
-                                return flags & SECCOMP_PARSE_LOG ? log_oom() : -ENOMEM;
+                                switch (r) {
+                                case -ENOMEM:
+                                        return flags & SECCOMP_PARSE_LOG ? log_oom() : -ENOMEM;
+                                case -EEXIST:
+                                        if (flags & SECCOMP_PARSE_LOG)
+                                                log_warning("System call %s already blocked with different errno: %d",
+                                                            name, PTR_TO_INT(hashmap_get(filter, INT_TO_PTR(id + 1))));
+                                        return -EINVAL;
+                                default:
+                                        return r;
+                                }
                 } else
                         (void) hashmap_remove(filter, INT_TO_PTR(id + 1));
         }