procd: Replace strerror(errno) with %m.

[project/procd.git] / jail / seccomp.c

diff --git a/jail/seccomp.c b/jail/seccomp.c
index dcd19ec..fae08f9 100644 (file)
--- a/jail/seccomp.c
+++ b/jail/seccomp.c
@@ -22,15 +22,15 @@
 #include "seccomp.h"
 #include "../syscall-names.h"
 
 #include "seccomp.h"
 #include "../syscall-names.h"
 

-static int max_syscall = ARRAY_SIZE(syscall_names);
-

 static int find_syscall(const char *name)
 {
        int i;
 
 static int find_syscall(const char *name)
 {
        int i;
 

-       for (i = 0; i < max_syscall; i++)
-               if (syscall_names[i] && !strcmp(syscall_names[i], name))
-                       return i;
+       for (i = 0; i < SYSCALL_COUNT; i++) {
+               int sc = syscall_index_to_number(i);
+               if (syscall_name(sc) && !strcmp(syscall_name(sc), name))
+                       return sc;
+       }

 
        return -1;
 }
 
        return -1;
 }


@@ -67,13 +67,13 @@ int install_syscall_filter(const char *argv, const char *file)
 
        blob_buf_init(&b, 0);
        if (!blobmsg_add_json_from_file(&b, file)) {
 
        blob_buf_init(&b, 0);
        if (!blobmsg_add_json_from_file(&b, file)) {

-               INFO("%s: failed to load %s\n", argv, file);
+               ERROR("%s: failed to load %s\n", argv, file);

                return -1;
        }
 
        blobmsg_parse(policy, __SECCOMP_MAX, tb, blob_data(b.head), blob_len(b.head));
        if (!tb[SECCOMP_WHITELIST]) {
                return -1;
        }
 
        blobmsg_parse(policy, __SECCOMP_MAX, tb, blob_data(b.head), blob_len(b.head));
        if (!tb[SECCOMP_WHITELIST]) {

-               INFO("%s: %s is missing the syscall table\n", argv, file);
+               ERROR("%s: %s is missing the syscall table\n", argv, file);

                return -1;
        }
 
                return -1;
        }
 


@@ -85,7 +85,7 @@ int install_syscall_filter(const char *argv, const char *file)
 
        filter = calloc(sz, sizeof(struct sock_filter));
        if (!filter) {
 
        filter = calloc(sz, sizeof(struct sock_filter));
        if (!filter) {

-               INFO("failed to allocate filter memory\n");
+               ERROR("failed to allocate filter memory\n");

                return -1;
        }
 
                return -1;
        }
 


@@ -118,14 +118,14 @@ int install_syscall_filter(const char *argv, const char *file)
        }
 
        if (default_policy)
        }
 
        if (default_policy)

-               /* return -1 and set errno */
-               set_filter(&filter[idx], BPF_RET + BPF_K, 0, 0, SECCOMP_RET_LOGGER(default_policy));
+               /* notify tracer; without tracer return -1 and set errno to ENOSYS */
+               set_filter(&filter[idx], BPF_RET + BPF_K, 0, 0, SECCOMP_RET_TRACE);

        else
                /* kill the process */
                set_filter(&filter[idx], BPF_RET + BPF_K, 0, 0, SECCOMP_RET_KILL);
 
        if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
        else
                /* kill the process */
                set_filter(&filter[idx], BPF_RET + BPF_K, 0, 0, SECCOMP_RET_KILL);
 
        if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {

-               INFO("%s: prctl(PR_SET_NO_NEW_PRIVS) failed: %s\n", argv, strerror(errno));
+               ERROR("%s: prctl(PR_SET_NO_NEW_PRIVS) failed: %m\n", argv);

                return errno;
        }
 
                return errno;
        }
 


@@ -133,7 +133,7 @@ int install_syscall_filter(const char *argv, const char *file)
        prog.filter = filter;
 
        if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog)) {
        prog.filter = filter;
 
        if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog)) {

-               INFO("%s: prctl(PR_SET_SECCOMP) failed: %s\n", argv, strerror(errno));
+               ERROR("%s: prctl(PR_SET_SECCOMP) failed: %m\n", argv);

                return errno;
        }
        return 0;
                return errno;
        }
        return 0;