netdev - Re: [PATCH iproute2 2/3] ip vrf: Improve cgroup2 error messages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 6 Jan 2017 12:45:20 +0300
From:   Sergei Shtylyov <sergei.shtylyov@...entembedded.com>
To:     David Ahern <dsa@...ulusnetworks.com>, netdev@...r.kernel.org,
        stephen@...workplumber.org
Subject: Re: [PATCH iproute2 2/3] ip vrf: Improve cgroup2 error messages

Hello!

On 1/6/2017 3:22 AM, David Ahern wrote:

> Currently, if a non-root user attempts to run ip vrf exec a non-helpful
> error is returned:
>
> $ ip vrf exec mgmt bash
> Failed to mount cgroup2. Are CGROUPS enabled in your kernel?
>
> Only show the CGROUPS kernel hint for the ENODEV error and for the
> rest show the strerror for the errno. So now:
>
> $ ip/ip vrf exec mgmt bash
> Failed to mount cgroup2: Operation not permitted
>
> Signed-off-by: David Ahern <dsa@...ulusnetworks.com>
> ---
>  lib/fs.c | 14 +++++++++++---
>  1 file changed, 11 insertions(+), 3 deletions(-)
>
> diff --git a/lib/fs.c b/lib/fs.c
> index 644bb486ae8e..12a4657a0bc9 100644
> --- a/lib/fs.c
> +++ b/lib/fs.c
> @@ -80,13 +80,21 @@ char *find_cgroup2_mount(void)
>
>  	if (mount("none", mnt, CGROUP2_FS_NAME, 0, NULL)) {
>  		/* EBUSY means already mounted */
> -		if (errno != EBUSY) {
> +		if (errno == EBUSY)
> +			goto out;
> +
> +		if (errno == ENODEV) {
>  			fprintf(stderr,
>  				"Failed to mount cgroup2. Are CGROUPS enabled in your kernel?\n");
> -			free(mnt);
> -			return NULL;
> +		} else {
> +			fprintf(stderr,
> +				"Failed to mount cgroup2: %s\n",
> +				strerror(errno));
>  		}

    How about a *switch* instead?

> +		free(mnt);
> +		return NULL;
>  	}
> +out:
>  	return mnt;
>  }
>

MBR, Sergei