External/passt
1
0
Fork 0
mirror of https://passt.top/passt synced 2024-06-30 15:02:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

convert all remaining err() followed by exit() to die()

Browse Source 
This actually leaves us with 0 uses of err(), but someone could want
to use it in the future, so we may as well leave it around.

Signed-off-by: Laine Stump <laine@redhat.com>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
This commit is contained in:
Laine Stump 2023-02-15 03:24:37 -05:00 committed by Stefano Brivio
parent a1ab1ca2ee
commit c9af6f92db
6 changed files with 47 additions and 91 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

67
isolation.c
View File

@ -103,10 +103,8 @@ static void drop_caps_ep_except(uint64_t keep)
struct __user_cap_data_struct data[CAP_WORDS]; struct __user_cap_data_struct data[CAP_WORDS];
int i; int i;
if (syscall(SYS_capget, &hdr, data)) { if (syscall(SYS_capget, &hdr, data))
err("Couldn't get current capabilities: %s", strerror(errno)); die("Couldn't get current capabilities: %s", strerror(errno));
exit(EXIT_FAILURE);
}
for (i = 0; i < CAP_WORDS; i++) { for (i = 0; i < CAP_WORDS; i++) {
uint32_t mask = keep >> (32 * i); uint32_t mask = keep >> (32 * i);
@ -115,10 +113,8 @@ static void drop_caps_ep_except(uint64_t keep)
data[i].permitted &= mask; data[i].permitted &= mask;
} }
if (syscall(SYS_capset, &hdr, data)) { if (syscall(SYS_capset, &hdr, data))
err("Couldn't drop capabilities: %s", strerror(errno)); die("Couldn't drop capabilities: %s", strerror(errno));
exit(EXIT_FAILURE);
}
} }
/** /**
@ -154,26 +150,20 @@ static void clamp_caps(void)
* normal operation, so carry on without it. * normal operation, so carry on without it.
*/ */
if (prctl(PR_CAPBSET_DROP, i, 0, 0, 0) && if (prctl(PR_CAPBSET_DROP, i, 0, 0, 0) &&
errno != EINVAL && errno != EPERM) { errno != EINVAL && errno != EPERM)
err("Couldn't drop cap %i from bounding set: %s", die("Couldn't drop cap %i from bounding set: %s",
i, strerror(errno)); i, strerror(errno));
exit(EXIT_FAILURE);
}
} }
if (syscall(SYS_capget, &hdr, data)) { if (syscall(SYS_capget, &hdr, data))
err("Couldn't get current capabilities: %s", strerror(errno)); die("Couldn't get current capabilities: %s", strerror(errno));
exit(EXIT_FAILURE);
}
for (i = 0; i < CAP_WORDS; i++) for (i = 0; i < CAP_WORDS; i++)
data[i].inheritable = 0; data[i].inheritable = 0;
if (syscall(SYS_capset, &hdr, data)) { if (syscall(SYS_capset, &hdr, data))
err("Couldn't drop inheritable capabilities: %s", die("Couldn't drop inheritable capabilities: %s",
strerror(errno)); strerror(errno));
exit(EXIT_FAILURE);
}
} }
/** /**
@ -229,46 +219,35 @@ void isolate_user(uid_t uid, gid_t gid, bool use_userns, const char *userns,
/* First set our UID & GID in the original namespace */ /* First set our UID & GID in the original namespace */
if (setgroups(0, NULL)) { if (setgroups(0, NULL)) {
/* If we don't have CAP_SETGID, this will EPERM */ /* If we don't have CAP_SETGID, this will EPERM */
if (errno != EPERM) { if (errno != EPERM)
err("Can't drop supplementary groups: %s", die("Can't drop supplementary groups: %s",
strerror(errno)); strerror(errno));
exit(EXIT_FAILURE);
}
} }
if (setgid(gid) != 0) { if (setgid(gid) != 0)
err("Can't set GID to %u: %s", gid, strerror(errno)); die("Can't set GID to %u: %s", gid, strerror(errno));
exit(EXIT_FAILURE);
}
if (setuid(uid) != 0) { if (setuid(uid) != 0)
err("Can't set UID to %u: %s", uid, strerror(errno)); die("Can't set UID to %u: %s", uid, strerror(errno));
exit(EXIT_FAILURE);
}
if (*userns) { /* If given a userns, join it */ if (*userns) { /* If given a userns, join it */
int ufd; int ufd;
ufd = open(userns, O_RDONLY | O_CLOEXEC); ufd = open(userns, O_RDONLY | O_CLOEXEC);
if (ufd < 0) { if (ufd < 0)
err("Couldn't open user namespace %s: %s", die("Couldn't open user namespace %s: %s",
userns, strerror(errno)); userns, strerror(errno));
exit(EXIT_FAILURE);
}
if (setns(ufd, CLONE_NEWUSER) != 0) { if (setns(ufd, CLONE_NEWUSER) != 0)
err("Couldn't enter user namespace %s: %s", die("Couldn't enter user namespace %s: %s",
userns, strerror(errno)); userns, strerror(errno));
exit(EXIT_FAILURE);
}
close(ufd); close(ufd);
} else if (use_userns) { /* Create and join a new userns */ } else if (use_userns) { /* Create and join a new userns */
if (unshare(CLONE_NEWUSER) != 0) { if (unshare(CLONE_NEWUSER) != 0)
err("Couldn't create user namespace: %s", strerror(errno)); die("Couldn't create user namespace: %s",
exit(EXIT_FAILURE); strerror(errno));
}
} }
/* Joining a new userns gives us full capabilities; drop the /* Joining a new userns gives us full capabilities; drop the

6
log.c
View File

@ -193,10 +193,8 @@ void logfile_init(const char *name, const char *path, size_t size)
log_file = open(path, O_CREAT | O_TRUNC | O_APPEND | O_RDWR | O_CLOEXEC, log_file = open(path, O_CREAT | O_TRUNC | O_APPEND | O_RDWR | O_CLOEXEC,
S_IRUSR | S_IWUSR); S_IRUSR | S_IWUSR);
if (log_file == -1) { if (log_file == -1)
err("Couldn't open log file %s: %s", path, strerror(errno)); die("Couldn't open log file %s: %s", path, strerror(errno));
exit(EXIT_FAILURE);
}
log_size = size ? size : LOGFILE_SIZE_DEFAULT; log_size = size ? size : LOGFILE_SIZE_DEFAULT;

3
netlink.c
View File

@ -90,8 +90,7 @@ void nl_sock_init(const struct ctx *c, bool ns)
return; return;
fail: fail:
err("Failed to get netlink socket"); die("Failed to get netlink socket");
exit(EXIT_FAILURE);
} }
/** /**

12
passt.c
View File

@ -202,10 +202,8 @@ int main(int argc, char **argv)
name = basename(argv0); name = basename(argv0);
if (strstr(name, "pasta")) { if (strstr(name, "pasta")) {
sa.sa_handler = pasta_child_handler; sa.sa_handler = pasta_child_handler;
if (sigaction(SIGCHLD, &sa, NULL) || signal(SIGPIPE, SIG_IGN)) { if (sigaction(SIGCHLD, &sa, NULL) || signal(SIGPIPE, SIG_IGN))
err("Couldn't install signal handlers"); die("Couldn't install signal handlers");
exit(EXIT_FAILURE);
}
c.mode = MODE_PASTA; c.mode = MODE_PASTA;
log_name = "pasta"; log_name = "pasta";
@ -284,10 +282,8 @@ int main(int argc, char **argv)
} }
} }
if (isolate_prefork(&c)) { if (isolate_prefork(&c))
err("Failed to sandbox process, exiting\n"); die("Failed to sandbox process, exiting");
exit(EXIT_FAILURE);
}
/* Once the log mask is not LOG_EMERG, we will no longer /* Once the log mask is not LOG_EMERG, we will no longer
* log to stderr if there was a log file specified. * log to stderr if there was a log file specified.

20
pasta.c
View File

@ -131,19 +131,15 @@ void pasta_open_ns(struct ctx *c, const char *netns)
int nfd = -1; int nfd = -1;
nfd = open(netns, O_RDONLY | O_CLOEXEC); nfd = open(netns, O_RDONLY | O_CLOEXEC);
if (nfd < 0) { if (nfd < 0)
err("Couldn't open network namespace %s", netns); die("Couldn't open network namespace %s", netns);
exit(EXIT_FAILURE);
}
c->pasta_netns_fd = nfd; c->pasta_netns_fd = nfd;
NS_CALL(ns_check, c); NS_CALL(ns_check, c);
if (c->pasta_netns_fd < 0) { if (c->pasta_netns_fd < 0)
err("Couldn't switch to pasta namespaces"); die("Couldn't switch to pasta namespaces");
exit(EXIT_FAILURE);
}
if (!c->no_netns_quit) { if (!c->no_netns_quit) {
char buf[PATH_MAX] = { 0 }; char buf[PATH_MAX] = { 0 };
@ -232,11 +228,9 @@ void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid,
arg.exe = "/bin/sh"; arg.exe = "/bin/sh";
if ((size_t)snprintf(sh_arg0, sizeof(sh_arg0), if ((size_t)snprintf(sh_arg0, sizeof(sh_arg0),
"-%s", arg.exe) >= sizeof(sh_arg0)) { "-%s", arg.exe) >= sizeof(sh_arg0))
err("$SHELL is too long (%u bytes)", die("$SHELL is too long (%u bytes)", strlen(arg.exe));
strlen(arg.exe));
exit(EXIT_FAILURE);
}
sh_argv[0] = sh_arg0; sh_argv[0] = sh_arg0;
arg.argv = sh_argv; arg.argv = sh_argv;
} }

30
tap.c
View File

@ -1008,10 +1008,8 @@ static void tap_sock_unix_init(struct ctx *c)
}; };
int i; int i;
if (fd < 0) { if (fd < 0)
err("UNIX socket: %s", strerror(errno)); die("UNIX socket: %s", strerror(errno));
exit(EXIT_FAILURE);
}
/* In passt mode, we don't know the guest's MAC until it sends /* In passt mode, we don't know the guest's MAC until it sends
* us packets. Use the broadcast address so our first packets * us packets. Use the broadcast address so our first packets
@ -1029,18 +1027,14 @@ static void tap_sock_unix_init(struct ctx *c)
snprintf(path, UNIX_PATH_MAX - 1, UNIX_SOCK_PATH, i); snprintf(path, UNIX_PATH_MAX - 1, UNIX_SOCK_PATH, i);
ex = socket(AF_UNIX, SOCK_STREAM | SOCK_NONBLOCK, 0); ex = socket(AF_UNIX, SOCK_STREAM | SOCK_NONBLOCK, 0);
if (ex < 0) { if (ex < 0)
err("UNIX domain socket check: %s", strerror(errno)); die("UNIX domain socket check: %s", strerror(errno));
exit(EXIT_FAILURE);
}
ret = connect(ex, (const struct sockaddr *)&addr, sizeof(addr)); ret = connect(ex, (const struct sockaddr *)&addr, sizeof(addr));
if (!ret || (errno != ENOENT && errno != ECONNREFUSED && if (!ret || (errno != ENOENT && errno != ECONNREFUSED &&
errno != EACCES)) { errno != EACCES)) {
if (*c->sock_path) { if (*c->sock_path)
err("Socket path %s already in use", path); die("Socket path %s already in use", path);
exit(EXIT_FAILURE);
}
close(ex); close(ex);
continue; continue;
@ -1053,10 +1047,8 @@ static void tap_sock_unix_init(struct ctx *c)
break; break;
} }
if (i == UNIX_SOCK_MAX) { if (i == UNIX_SOCK_MAX)
err("UNIX socket bind: %s", strerror(errno)); die("UNIX socket bind: %s", strerror(errno));
exit(EXIT_FAILURE);
}
info("UNIX domain socket bound at %s\n", addr.sun_path); info("UNIX domain socket bound at %s\n", addr.sun_path);
@ -1159,10 +1151,8 @@ static void tap_sock_tun_init(struct ctx *c)
struct epoll_event ev = { 0 }; struct epoll_event ev = { 0 };
NS_CALL(tap_ns_tun, c); NS_CALL(tap_ns_tun, c);
if (tun_ns_fd == -1) { if (tun_ns_fd == -1)
err("Failed to open tun socket in namespace"); die("Failed to open tun socket in namespace");
exit(EXIT_FAILURE);
}
pasta_ns_conf(c); pasta_ns_conf(c);