From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Wed, 5 Sep 2018 06:12:37 +0000 (+0900)
Subject: core/execute: do not use the negative errno when setup_namespace() returns -ENOANO
X-Git-Tag: v240~716^2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F10114%2Fhead;p=thirdparty%2Fsystemd.git

core/execute: do not use the negative errno when setup_namespace() returns -ENOANO

Without this, log shows meaningless error message 'No anode', e.g.,
===
Failed to unshare the mount namespace: Operation not permitted
foo.service: Failed to set up mount namespacing: No anode
foo.service: Failed at step NAMESPACE spawning /usr/bin/test: No anode
===

Follow-up for 1beab8b0d0ff2d7d1436b52d4a0c3d56dc908962.
---

diff --git a/src/core/execute.c b/src/core/execute.c
index 501b367eae9..35dd3898dae 100644
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -2400,12 +2400,16 @@ static int apply_mount_namespace(
          * that with a special, recognizable error ENOANO. In this case, silently proceeed, but only if exclusively
          * sandboxing options were used, i.e. nothing such as RootDirectory= or BindMount= that would result in a
          * completely different execution environment. */
-        if (r == -ENOANO &&
-            n_bind_mounts == 0 && context->n_temporary_filesystems == 0 &&
-            !root_dir && !root_image &&
-            !context->dynamic_user) {
-                log_unit_debug(u, "Failed to set up namespace, assuming containerized execution and ignoring.");
-                return 0;
+        if (r == -ENOANO) {
+                if (n_bind_mounts == 0 &&
+                    context->n_temporary_filesystems == 0 &&
+                    !root_dir && !root_image &&
+                    !context->dynamic_user) {
+                        log_unit_debug(u, "Failed to set up namespace, assuming containerized execution and ignoring.");
+                        return 0;
+                }
+
+                return -EOPNOTSUPP;
         }
 
         return r;