seccomp: handle all errors

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

diff --git a/src/lxc/seccomp.c b/src/lxc/seccomp.c
index 5da31a563169ca172c0c9157879d08c99f5239e7..60118852d436fed2178814c74b504943ebac3f2a 100644 (file)
--- a/src/lxc/seccomp.c
+++ b/src/lxc/seccomp.c
@@ -371,20 +371,34 @@ scmp_filter_ctx get_new_ctx(enum lxc_hostarch_t n_arch, uint32_t default_policy_
        }
 #endif
 
-       if (seccomp_arch_exist(ctx, arch) == -EEXIST) {
+       ret = seccomp_arch_exist(ctx, arch);
+       if (ret < 0) {
+               if (ret != -EEXIST) {
+                       ERROR("%s - Failed to determine whether arch %d is "
+                             "already present in the main seccomp context",
+                              strerror(-ret), (int)n_arch);
+                       seccomp_release(ctx);
+                       return NULL;
+               }
+
                ret = seccomp_arch_add(ctx, arch);
                if (ret != 0) {
-                       ERROR("Seccomp error %d (%s) adding arch: %d", ret,
-                                       strerror(-ret), (int)n_arch);
+                       ERROR("%s - Failed to add arch %d to main seccomp context",
+                             strerror(-ret), (int)n_arch);
                        seccomp_release(ctx);
                        return NULL;
                }
+               TRACE("Added arch %d to main seccomp context", (int)n_arch);
 
-               if (seccomp_arch_remove(ctx, SCMP_ARCH_NATIVE) != 0) {
-                       ERROR("Seccomp error removing native arch");
+               ret = seccomp_arch_remove(ctx, SCMP_ARCH_NATIVE);
+               if (ret != 0) {
+                       ERROR("Failed to remove native arch from main seccomp context");
                        seccomp_release(ctx);
                        return NULL;
                }
+               TRACE("Removed native arch from main seccomp context");
+       } else {
+               TRACE("Arch %d already present in main seccomp context", (int)n_arch);
        }
 
        return ctx;