Skip to content

libcrun_initialize_apparmor() implementation could have more robust error handling #1936

@eriksjolund

Description

@eriksjolund

This is of little importance.

When reading this code

crun/src/libcrun/utils.c

Lines 757 to 761 in df04868

if (crun_dir_p_at (AT_FDCWD, "/sys/kernel/security/apparmor", true, err))
{
fd = open ("/sys/module/apparmor/parameters/enabled", O_RDONLY | O_CLOEXEC);
if (fd == -1)
return 0;

it seems an error would be leaked if both /sys/kernel/security/apparmor and /sys/module/apparmor/parameters/enabled do not exist, because crun_dir_p_at() would return -1 and open() would return -1.

(I haven't verified this by actually running the code, but I studied the crun_dir_p_at() implementation and the return value section
of the man pages of statx(), fstatat() and open())

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions