External/passt
1
0
Fork 0
mirror of https://passt.top/passt synced 2024-06-23 11:37:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

convert all remaining err() followed by exit() to die()

Browse Source 
This actually leaves us with 0 uses of err(), but someone could want
to use it in the future, so we may as well leave it around.

Signed-off-by: Laine Stump <laine@redhat.com>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
This commit is contained in:
Laine Stump 2023-02-15 03:24:37 -05:00 committed by Stefano Brivio
parent a1ab1ca2ee
commit c9af6f92db
6 changed files with 47 additions and 91 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

67
isolation.c
View File

@ -103,10 +103,8 @@ static void drop_caps_ep_except(uint64_t keep)
struct __user_cap_data_struct data[CAP_WORDS];
int i;
if (syscall(SYS_capget, &hdr, data)) {
err("Couldn't get current capabilities: %s", strerror(errno));
exit(EXIT_FAILURE);
}
if (syscall(SYS_capget, &hdr, data))
die("Couldn't get current capabilities: %s", strerror(errno));
for (i = 0; i < CAP_WORDS; i++) {
uint32_t mask = keep >> (32 * i);
@ -115,10 +113,8 @@ static void drop_caps_ep_except(uint64_t keep)
data[i].permitted &= mask;
}
if (syscall(SYS_capset, &hdr, data)) {
err("Couldn't drop capabilities: %s", strerror(errno));
exit(EXIT_FAILURE);
}
if (syscall(SYS_capset, &hdr, data))
die("Couldn't drop capabilities: %s", strerror(errno));
}
/**
@ -154,26 +150,20 @@ static void clamp_caps(void)
* normal operation, so carry on without it.
*/
if (prctl(PR_CAPBSET_DROP, i, 0, 0, 0) &&
errno != EINVAL && errno != EPERM) {
err("Couldn't drop cap %i from bounding set: %s",
errno != EINVAL && errno != EPERM)
die("Couldn't drop cap %i from bounding set: %s",
i, strerror(errno));
exit(EXIT_FAILURE);
}
}
if (syscall(SYS_capget, &hdr, data)) {
err("Couldn't get current capabilities: %s", strerror(errno));
exit(EXIT_FAILURE);
}
if (syscall(SYS_capget, &hdr, data))
die("Couldn't get current capabilities: %s", strerror(errno));
for (i = 0; i < CAP_WORDS; i++)
data[i].inheritable = 0;
if (syscall(SYS_capset, &hdr, data)) {
err("Couldn't drop inheritable capabilities: %s",
if (syscall(SYS_capset, &hdr, data))
die("Couldn't drop inheritable capabilities: %s",
strerror(errno));
exit(EXIT_FAILURE);
}
}
/**
@ -229,46 +219,35 @@ void isolate_user(uid_t uid, gid_t gid, bool use_userns, const char *userns,
/* First set our UID & GID in the original namespace */
if (setgroups(0, NULL)) {
/* If we don't have CAP_SETGID, this will EPERM */
if (errno != EPERM) {
err("Can't drop supplementary groups: %s",
if (errno != EPERM)
die("Can't drop supplementary groups: %s",
strerror(errno));
exit(EXIT_FAILURE);
}
}
if (setgid(gid) != 0) {
err("Can't set GID to %u: %s", gid, strerror(errno));
exit(EXIT_FAILURE);
}
if (setgid(gid) != 0)
die("Can't set GID to %u: %s", gid, strerror(errno));
if (setuid(uid) != 0) {
err("Can't set UID to %u: %s", uid, strerror(errno));
exit(EXIT_FAILURE);
}
if (setuid(uid) != 0)
die("Can't set UID to %u: %s", uid, strerror(errno));
if (*userns) { /* If given a userns, join it */
int ufd;
ufd = open(userns, O_RDONLY | O_CLOEXEC);
if (ufd < 0) {
err("Couldn't open user namespace %s: %s",
if (ufd < 0)
die("Couldn't open user namespace %s: %s",
userns, strerror(errno));
exit(EXIT_FAILURE);
}
if (setns(ufd, CLONE_NEWUSER) != 0) {
err("Couldn't enter user namespace %s: %s",
if (setns(ufd, CLONE_NEWUSER) != 0)
die("Couldn't enter user namespace %s: %s",
userns, strerror(errno));
exit(EXIT_FAILURE);
}
close(ufd);
} else if (use_userns) { /* Create and join a new userns */
if (unshare(CLONE_NEWUSER) != 0) {
err("Couldn't create user namespace: %s", strerror(errno));
exit(EXIT_FAILURE);
}
if (unshare(CLONE_NEWUSER) != 0)
die("Couldn't create user namespace: %s",
strerror(errno));
}
/* Joining a new userns gives us full capabilities; drop the

6
log.c
View File

@ -193,10 +193,8 @@ void logfile_init(const char *name, const char *path, size_t size)
log_file = open(path, O_CREAT | O_TRUNC | O_APPEND | O_RDWR | O_CLOEXEC,
S_IRUSR | S_IWUSR);
if (log_file == -1) {
err("Couldn't open log file %s: %s", path, strerror(errno));
exit(EXIT_FAILURE);
}
if (log_file == -1)
die("Couldn't open log file %s: %s", path, strerror(errno));
log_size = size ? size : LOGFILE_SIZE_DEFAULT;

3
netlink.c
View File

@ -90,8 +90,7 @@ void nl_sock_init(const struct ctx *c, bool ns)
return;
fail:
err("Failed to get netlink socket");
exit(EXIT_FAILURE);
die("Failed to get netlink socket");
}
/**

12
passt.c
View File

@ -202,10 +202,8 @@ int main(int argc, char **argv)
name = basename(argv0);
if (strstr(name, "pasta")) {
sa.sa_handler = pasta_child_handler;
if (sigaction(SIGCHLD, &sa, NULL) || signal(SIGPIPE, SIG_IGN)) {
err("Couldn't install signal handlers");
exit(EXIT_FAILURE);
}
if (sigaction(SIGCHLD, &sa, NULL) || signal(SIGPIPE, SIG_IGN))
die("Couldn't install signal handlers");
c.mode = MODE_PASTA;
log_name = "pasta";
@ -284,10 +282,8 @@ int main(int argc, char **argv)
}
}
if (isolate_prefork(&c)) {
err("Failed to sandbox process, exiting\n");
exit(EXIT_FAILURE);
}
if (isolate_prefork(&c))
die("Failed to sandbox process, exiting");
/* Once the log mask is not LOG_EMERG, we will no longer
* log to stderr if there was a log file specified.

20
pasta.c
View File

@ -131,19 +131,15 @@ void pasta_open_ns(struct ctx *c, const char *netns)
int nfd = -1;
nfd = open(netns, O_RDONLY | O_CLOEXEC);
if (nfd < 0) {
err("Couldn't open network namespace %s", netns);
exit(EXIT_FAILURE);
}
if (nfd < 0)
die("Couldn't open network namespace %s", netns);
c->pasta_netns_fd = nfd;
NS_CALL(ns_check, c);
if (c->pasta_netns_fd < 0) {
err("Couldn't switch to pasta namespaces");
exit(EXIT_FAILURE);
}
if (c->pasta_netns_fd < 0)
die("Couldn't switch to pasta namespaces");
if (!c->no_netns_quit) {
char buf[PATH_MAX] = { 0 };
@ -232,11 +228,9 @@ void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid,
arg.exe = "/bin/sh";
if ((size_t)snprintf(sh_arg0, sizeof(sh_arg0),
"-%s", arg.exe) >= sizeof(sh_arg0)) {
err("$SHELL is too long (%u bytes)",
strlen(arg.exe));
exit(EXIT_FAILURE);
}
"-%s", arg.exe) >= sizeof(sh_arg0))
die("$SHELL is too long (%u bytes)", strlen(arg.exe));
sh_argv[0] = sh_arg0;
arg.argv = sh_argv;
}

30
tap.c
View File

@ -1008,10 +1008,8 @@ static void tap_sock_unix_init(struct ctx *c)
};
int i;
if (fd < 0) {
err("UNIX socket: %s", strerror(errno));
exit(EXIT_FAILURE);
}
if (fd < 0)
die("UNIX socket: %s", strerror(errno));
/* In passt mode, we don't know the guest's MAC until it sends
* us packets. Use the broadcast address so our first packets
@ -1029,18 +1027,14 @@ static void tap_sock_unix_init(struct ctx *c)
snprintf(path, UNIX_PATH_MAX - 1, UNIX_SOCK_PATH, i);
ex = socket(AF_UNIX, SOCK_STREAM | SOCK_NONBLOCK, 0);
if (ex < 0) {
err("UNIX domain socket check: %s", strerror(errno));
exit(EXIT_FAILURE);
}
if (ex < 0)
die("UNIX domain socket check: %s", strerror(errno));
ret = connect(ex, (const struct sockaddr *)&addr, sizeof(addr));
if (!ret || (errno != ENOENT && errno != ECONNREFUSED &&
errno != EACCES)) {
if (*c->sock_path) {
err("Socket path %s already in use", path);
exit(EXIT_FAILURE);
}
if (*c->sock_path)
die("Socket path %s already in use", path);
close(ex);
continue;
@ -1053,10 +1047,8 @@ static void tap_sock_unix_init(struct ctx *c)
break;
}
if (i == UNIX_SOCK_MAX) {
err("UNIX socket bind: %s", strerror(errno));
exit(EXIT_FAILURE);
}
if (i == UNIX_SOCK_MAX)
die("UNIX socket bind: %s", strerror(errno));
info("UNIX domain socket bound at %s\n", addr.sun_path);
@ -1159,10 +1151,8 @@ static void tap_sock_tun_init(struct ctx *c)
struct epoll_event ev = { 0 };
NS_CALL(tap_ns_tun, c);
if (tun_ns_fd == -1) {
err("Failed to open tun socket in namespace");
exit(EXIT_FAILURE);
}
if (tun_ns_fd == -1)
die("Failed to open tun socket in namespace");
pasta_ns_conf(c);