On Wed, Feb 15, 2023 at 03:24:37AM -0500, Laine Stump wrote:
> This actually leaves us with 0 uses of err(), but someone could want
> to use it in the future, so we may as well leave it around.
> 
> Signed-off-by: Laine Stump <laine@redhat.com>

Reviewed-by: David Gibson <david@gibson.dropbear.id.au>

> ---
>  isolation.c | 67 ++++++++++++++++++-----------------------------------
>  log.c       |  6 ++---
>  netlink.c   |  3 +--
>  passt.c     | 12 ++++------
>  pasta.c     | 20 ++++++----------
>  tap.c       | 30 ++++++++----------------
>  6 files changed, 47 insertions(+), 91 deletions(-)
> 
> diff --git a/isolation.c b/isolation.c
> index 4e6637d..6bae4d4 100644
> --- a/isolation.c
> +++ b/isolation.c
> @@ -103,10 +103,8 @@ static void drop_caps_ep_except(uint64_t keep)
>  	struct __user_cap_data_struct data[CAP_WORDS];
>  	int i;
>  
> -	if (syscall(SYS_capget, &hdr, data)) {
> -		err("Couldn't get current capabilities: %s", strerror(errno));
> -		exit(EXIT_FAILURE);
> -	}
> +	if (syscall(SYS_capget, &hdr, data))
> +		die("Couldn't get current capabilities: %s", strerror(errno));
>  
>  	for (i = 0; i < CAP_WORDS; i++) {
>  		uint32_t mask = keep >> (32 * i);
> @@ -115,10 +113,8 @@ static void drop_caps_ep_except(uint64_t keep)
>  		data[i].permitted &= mask;
>  	}
>  
> -	if (syscall(SYS_capset, &hdr, data)) {
> -		err("Couldn't drop capabilities: %s", strerror(errno));
> -		exit(EXIT_FAILURE);
> -	}
> +	if (syscall(SYS_capset, &hdr, data))
> +		die("Couldn't drop capabilities: %s", strerror(errno));
>  }
>  
>  /**
> @@ -154,26 +150,20 @@ static void clamp_caps(void)
>  		 *   normal operation, so carry on without it.
>  		 */
>  		if (prctl(PR_CAPBSET_DROP, i, 0, 0, 0) &&
> -		    errno != EINVAL && errno != EPERM) {
> -			err("Couldn't drop cap %i from bounding set: %s",
> +		    errno != EINVAL && errno != EPERM)
> +			die("Couldn't drop cap %i from bounding set: %s",
>  			    i, strerror(errno));
> -			exit(EXIT_FAILURE);
> -		}
>  	}
>  
> -	if (syscall(SYS_capget, &hdr, data)) {
> -		err("Couldn't get current capabilities: %s", strerror(errno));
> -		exit(EXIT_FAILURE);
> -	}
> +	if (syscall(SYS_capget, &hdr, data))
> +		die("Couldn't get current capabilities: %s", strerror(errno));
>  
>  	for (i = 0; i < CAP_WORDS; i++)
>  		data[i].inheritable = 0;
>  
> -	if (syscall(SYS_capset, &hdr, data)) {
> -		err("Couldn't drop inheritable capabilities: %s",
> +	if (syscall(SYS_capset, &hdr, data))
> +		die("Couldn't drop inheritable capabilities: %s",
>  		    strerror(errno));
> -		exit(EXIT_FAILURE);
> -	}
>  }
>  
>  /**
> @@ -229,46 +219,35 @@ void isolate_user(uid_t uid, gid_t gid, bool use_userns, const char *userns,
>  	/* First set our UID & GID in the original namespace */
>  	if (setgroups(0, NULL)) {
>  		/* If we don't have CAP_SETGID, this will EPERM */
> -		if (errno != EPERM) {
> -			err("Can't drop supplementary groups: %s",
> +		if (errno != EPERM)
> +			die("Can't drop supplementary groups: %s",
>  			    strerror(errno));
> -			exit(EXIT_FAILURE);
> -		}
>  	}
>  
> -	if (setgid(gid) != 0) {
> -		err("Can't set GID to %u: %s", gid, strerror(errno));
> -		exit(EXIT_FAILURE);
> -	}
> +	if (setgid(gid) != 0)
> +		die("Can't set GID to %u: %s", gid, strerror(errno));
>  
> -	if (setuid(uid) != 0) {
> -		err("Can't set UID to %u: %s", uid, strerror(errno));
> -		exit(EXIT_FAILURE);
> -	}
> +	if (setuid(uid) != 0)
> +		die("Can't set UID to %u: %s", uid, strerror(errno));
>  
>  	if (*userns) { /* If given a userns, join it */
>  		int ufd;
>  
>  		ufd = open(userns, O_RDONLY | O_CLOEXEC);
> -		if (ufd < 0) {
> -			err("Couldn't open user namespace %s: %s",
> +		if (ufd < 0)
> +			die("Couldn't open user namespace %s: %s",
>  			    userns, strerror(errno));
> -			exit(EXIT_FAILURE);
> -		}
>  
> -		if (setns(ufd, CLONE_NEWUSER) != 0) {
> -			err("Couldn't enter user namespace %s: %s",
> +		if (setns(ufd, CLONE_NEWUSER) != 0)
> +			die("Couldn't enter user namespace %s: %s",
>  			    userns, strerror(errno));
> -			exit(EXIT_FAILURE);
> -		}
>  
>  		close(ufd);
>  
>  	} else if (use_userns) { /* Create and join a new userns */
> -		if (unshare(CLONE_NEWUSER) != 0) {
> -			err("Couldn't create user namespace: %s", strerror(errno));
> -			exit(EXIT_FAILURE);
> -		}
> +		if (unshare(CLONE_NEWUSER) != 0)
> +			die("Couldn't create user namespace: %s",
> +			    strerror(errno));
>  	}
>  
>  	/* Joining a new userns gives us full capabilities; drop the
> diff --git a/log.c b/log.c
> index 2920aba..785bc36 100644
> --- a/log.c
> +++ b/log.c
> @@ -193,10 +193,8 @@ void logfile_init(const char *name, const char *path, size_t size)
>  
>  	log_file = open(path, O_CREAT | O_TRUNC | O_APPEND | O_RDWR | O_CLOEXEC,
>  			S_IRUSR | S_IWUSR);
> -	if (log_file == -1) {
> -		err("Couldn't open log file %s: %s", path, strerror(errno));
> -		exit(EXIT_FAILURE);
> -	}
> +	if (log_file == -1)
> +		die("Couldn't open log file %s: %s", path, strerror(errno));
>  
>  	log_size = size ? size : LOGFILE_SIZE_DEFAULT;
>  
> diff --git a/netlink.c b/netlink.c
> index b8fa2a0..8f785ca 100644
> --- a/netlink.c
> +++ b/netlink.c
> @@ -90,8 +90,7 @@ void nl_sock_init(const struct ctx *c, bool ns)
>  	return;
>  
>  fail:
> -	err("Failed to get netlink socket");
> -	exit(EXIT_FAILURE);
> +	die("Failed to get netlink socket");
>  }
>  
>  /**
> diff --git a/passt.c b/passt.c
> index c48c2d5..5b8146e 100644
> --- a/passt.c
> +++ b/passt.c
> @@ -202,10 +202,8 @@ int main(int argc, char **argv)
>  	name = basename(argv0);
>  	if (strstr(name, "pasta")) {
>  		sa.sa_handler = pasta_child_handler;
> -		if (sigaction(SIGCHLD, &sa, NULL) || signal(SIGPIPE, SIG_IGN)) {
> -			err("Couldn't install signal handlers");
> -			exit(EXIT_FAILURE);
> -		}
> +		if (sigaction(SIGCHLD, &sa, NULL) || signal(SIGPIPE, SIG_IGN))
> +			die("Couldn't install signal handlers");
>  
>  		c.mode = MODE_PASTA;
>  		log_name = "pasta";
> @@ -284,10 +282,8 @@ int main(int argc, char **argv)
>  		}
>  	}
>  
> -	if (isolate_prefork(&c)) {
> -		err("Failed to sandbox process, exiting\n");
> -		exit(EXIT_FAILURE);
> -	}
> +	if (isolate_prefork(&c))
> +		die("Failed to sandbox process, exiting");
>  
>  	/* Once the log mask is not LOG_EMERG, we will no longer
>  	 * log to stderr if there was a log file specified.
> diff --git a/pasta.c b/pasta.c
> index d4d3dc8..6c9a412 100644
> --- a/pasta.c
> +++ b/pasta.c
> @@ -131,19 +131,15 @@ void pasta_open_ns(struct ctx *c, const char *netns)
>  	int nfd = -1;
>  
>  	nfd = open(netns, O_RDONLY | O_CLOEXEC);
> -	if (nfd < 0) {
> -		err("Couldn't open network namespace %s", netns);
> -		exit(EXIT_FAILURE);
> -	}
> +	if (nfd < 0)
> +		die("Couldn't open network namespace %s", netns);
>  
>  	c->pasta_netns_fd = nfd;
>  
>  	NS_CALL(ns_check, c);
>  
> -	if (c->pasta_netns_fd < 0) {
> -		err("Couldn't switch to pasta namespaces");
> -		exit(EXIT_FAILURE);
> -	}
> +	if (c->pasta_netns_fd < 0)
> +		die("Couldn't switch to pasta namespaces");
>  
>  	if (!c->no_netns_quit) {
>  		char buf[PATH_MAX] = { 0 };
> @@ -232,11 +228,9 @@ void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid,
>  			arg.exe = "/bin/sh";
>  
>  		if ((size_t)snprintf(sh_arg0, sizeof(sh_arg0),
> -				     "-%s", arg.exe) >= sizeof(sh_arg0)) {
> -			err("$SHELL is too long (%u bytes)",
> -			    strlen(arg.exe));
> -			exit(EXIT_FAILURE);
> -		}
> +				     "-%s", arg.exe) >= sizeof(sh_arg0))
> +			die("$SHELL is too long (%u bytes)", strlen(arg.exe));
> +
>  		sh_argv[0] = sh_arg0;
>  		arg.argv = sh_argv;
>  	}
> diff --git a/tap.c b/tap.c
> index 716d887..02da84d 100644
> --- a/tap.c
> +++ b/tap.c
> @@ -1008,10 +1008,8 @@ static void tap_sock_unix_init(struct ctx *c)
>  	};
>  	int i;
>  
> -	if (fd < 0) {
> -		err("UNIX socket: %s", strerror(errno));
> -		exit(EXIT_FAILURE);
> -	}
> +	if (fd < 0)
> +		die("UNIX socket: %s", strerror(errno));
>  
>  	/* In passt mode, we don't know the guest's MAC until it sends
>  	 * us packets.  Use the broadcast address so our first packets
> @@ -1029,18 +1027,14 @@ static void tap_sock_unix_init(struct ctx *c)
>  			snprintf(path, UNIX_PATH_MAX - 1, UNIX_SOCK_PATH, i);
>  
>  		ex = socket(AF_UNIX, SOCK_STREAM | SOCK_NONBLOCK, 0);
> -		if (ex < 0) {
> -			err("UNIX domain socket check: %s", strerror(errno));
> -			exit(EXIT_FAILURE);
> -		}
> +		if (ex < 0)
> +			die("UNIX domain socket check: %s", strerror(errno));
>  
>  		ret = connect(ex, (const struct sockaddr *)&addr, sizeof(addr));
>  		if (!ret || (errno != ENOENT && errno != ECONNREFUSED &&
>  			     errno != EACCES)) {
> -			if (*c->sock_path) {
> -				err("Socket path %s already in use", path);
> -				exit(EXIT_FAILURE);
> -			}
> +			if (*c->sock_path)
> +				die("Socket path %s already in use", path);
>  
>  			close(ex);
>  			continue;
> @@ -1053,10 +1047,8 @@ static void tap_sock_unix_init(struct ctx *c)
>  			break;
>  	}
>  
> -	if (i == UNIX_SOCK_MAX) {
> -		err("UNIX socket bind: %s", strerror(errno));
> -		exit(EXIT_FAILURE);
> -	}
> +	if (i == UNIX_SOCK_MAX)
> +		die("UNIX socket bind: %s", strerror(errno));
>  
>  	info("UNIX domain socket bound at %s\n", addr.sun_path);
>  
> @@ -1159,10 +1151,8 @@ static void tap_sock_tun_init(struct ctx *c)
>  	struct epoll_event ev = { 0 };
>  
>  	NS_CALL(tap_ns_tun, c);
> -	if (tun_ns_fd == -1) {
> -		err("Failed to open tun socket in namespace");
> -		exit(EXIT_FAILURE);
> -	}
> +	if (tun_ns_fd == -1)
> +		die("Failed to open tun socket in namespace");
>  
>  	pasta_ns_conf(c);
>  

-- 
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/~dgibson