Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

BUG: AddRule: fix to handle EACCES #74

Closed
wants to merge 2 commits into from
Closed

BUG: AddRule: fix to handle EACCES #74

wants to merge 2 commits into from

Commits on Sep 18, 2021

  1. seccomp_internal: use errors.New, add errDefAction 

    The latter is to be used by the next commit.

While at it, slightly improve the errBadFilter doc string.

NOTE that there are more places that need s/fmt.Errorf/errors.New/, but
as such change is trivial and it will break other commit pending review,
I am going to implement it separately later.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
    @kolyshkin
    kolyshkin committed Sep 18, 2021
    Configuration menu
    Copy the full SHA
    2d80251 View commit details
    Browse the repository at this point in the history

  2. AddRule: fix to handle EACCES 

    In case a rule with the action that equals to the default one was added,
libseccomp used to return EPERM, and libseccomp-golang converted it into
a more user-friendly "requested action matches default action of
filter" error.

From various bug reports I have noticed this is no longer a case.

The cause is libseccomp commit 83989be02 (appeared in v2.5.0), which
changes EPERM to EACCES.

Since we still support libseccomp < 2.5.0, check for either EPERM or
EACCES. Add a TODO item to remove the former.

Add a test case, which fails like this before the fix:

> seccomp_test.go:580: expected error to contain "matches default action", got "permission denied"

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
    @kolyshkin
    kolyshkin committed Sep 18, 2021
    Configuration menu
    Copy the full SHA
    cb4abba View commit details
    Browse the repository at this point in the history