From 09406a2f1d54ec4c9521b19857e200e102345833 Mon Sep 17 00:00:00 2001 From: huangwenbin Date: Mon, 31 Aug 2026 15:51:44 +0800 Subject: [PATCH] pfc: propagate buffered output errors gen_pfc_generate() ignored errors reported by fflush() and fclose(), causing seccomp_export_pfc() to report success even when buffered output could not be written. Preserve the first output error while still closing the stream, and add a regression test using /dev/full. Signed-off-by: huangwenbin --- src/gen_pfc.c | 10 ++++++---- tests/11-basic-basic_errors.c | 13 ++++++++++++- 2 files changed, 18 insertions(+), 5 deletions(-) diff --git a/src/gen_pfc.c b/src/gen_pfc.c index 91017166..3bcca7b9 100644 --- a/src/gen_pfc.c +++ b/src/gen_pfc.c @@ -480,7 +480,7 @@ static int _gen_pfc_arch(const struct db_filter_col *col, */ int gen_pfc_generate(const struct db_filter_col *col, int fd) { - int newfd; + int newfd, rc = 0; unsigned int iter; FILE *fds; @@ -508,8 +508,10 @@ int gen_pfc_generate(const struct db_filter_col *col, int fd) fprintf(fds, "# pseudo filter code end\n"); fprintf(fds, "#\n"); - fflush(fds); - fclose(fds); + if (fflush(fds) < 0) + rc = -errno; + if (fclose(fds) < 0 && rc == 0) + rc = -errno; - return 0; + return rc; } diff --git a/tests/11-basic-basic_errors.c b/tests/11-basic-basic_errors.c index dcfa7c28..09fd22b9 100644 --- a/tests/11-basic-basic_errors.c +++ b/tests/11-basic-basic_errors.c @@ -20,13 +20,14 @@ */ #include +#include #include #include int main(int argc, char *argv[]) { - int rc; + int fd, rc; scmp_filter_ctx ctx; uint32_t attr; unsigned int api; @@ -159,6 +160,16 @@ int main(int argc, char *argv[]) rc = seccomp_export_pfc(ctx, sysconf(_SC_OPEN_MAX) - 1); if (rc != -ECANCELED) return -1; + rc = seccomp_attr_set(ctx, SCMP_FLTATR_API_SYSRAWRC, 1); + if (rc != 0) + return -1; + fd = open("/dev/full", O_WRONLY); + if (fd < 0) + return -1; + rc = seccomp_export_pfc(ctx, fd); + close(fd); + if (rc != -ENOSPC) + return -1; } seccomp_release(ctx); ctx = NULL;