From 5c0342ba2ce8439d2447ff6531c5f9fa790d0a53 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mauricio=20V=C3=A1squez?= Date: Wed, 3 Feb 2021 16:06:32 -0500 Subject: [PATCH] libcontainer: fix bad conversion from syscall.Errno to error MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The correct way to do that conversion according to https://pkg.go.dev/syscall#Errno is: ``` err = nil if errno != 0 { err = errno } ``` In this case the error check will always report a false positive in unix.RawSyscall(unix.SYS_SECCOMP, ...), probably nobody has faced this problem because the code takes the other path in most of the cases. Fixes: 7a8d7162f9d7 ("seccomp: prepend -ENOSYS stub to all filters") Signed-off-by: Mauricio Vásquez --- libcontainer/seccomp/patchbpf/enosys_linux.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libcontainer/seccomp/patchbpf/enosys_linux.go b/libcontainer/seccomp/patchbpf/enosys_linux.go index cdbd59da0..a18761031 100644 --- a/libcontainer/seccomp/patchbpf/enosys_linux.go +++ b/libcontainer/seccomp/patchbpf/enosys_linux.go @@ -584,9 +584,12 @@ func sysSeccompSetFilter(flags uint, filter []unix.SockFilter) (err error) { unix.SECCOMP_MODE_FILTER, uintptr(unsafe.Pointer(&fprog)), 0, 0) } else { - _, _, err = unix.RawSyscall(unix.SYS_SECCOMP, + _, _, errno := unix.RawSyscall(unix.SYS_SECCOMP, uintptr(C.C_SET_MODE_FILTER), uintptr(flags), uintptr(unsafe.Pointer(&fprog))) + if errno != 0 { + err = errno + } } runtime.KeepAlive(filter) runtime.KeepAlive(fprog)