Hello Günther!

On 4/15/23 09:16, Günther Noack wrote:
> Hello Alejandro!
> 
>>> +if (abi <= 0) {
>>> +    perror("Giving up \- No Landlock support");
>>
>> Using perror(3) will already print "Operation not supported", since
>> errno is ENOTSUP.  Maybe this string is redundant?  How about the
>> following?
>>
>> 	perror("landlock_create_ruleset");  // EOPNOTSUPP
> 
> The fallback code assumes that we don't know the kernel that we run on,
> so in practice we also have to handle ENOSYS.
> 
> See https://docs.kernel.org/userspace-api/landlock.html#landlock-abi-versions
> 
> I'd suggest to just make it more explicit here that it can be two
> different error codes:
> 
> if (abi <= 0) {
>     /* ENOTSUP or ENOSYS */
>     perror("Giving up \- No Landlock support");
> }
> 
> Does that sound reasonable?

Sounds reasonable (with a call to exit(3) too).

BTW, now I see ENOSYS is not documented in syscall(2) (there's actually no
ERRORS section there).  Should we add it?

> 
> 
>> BTW, now I checked that while in Linux ENOTSUP and EOPNOTSUPP are
>> equivalent, in POSIX the latter has a connotation that it's about
>> sockets.  Should we document ENOTSUP in landlock_create_ruleset(2)
>> instead of EOPNOTSUPP?
> 
> EOPNOTSUP is also used in Landlock's kernel documentation,
> we'd maybe have to update it there as well.
> I'll have a look at what is more common.

Thanks.  In the man pages I see both often, so maybe we need to fix
consistency there too.

Cheers,
Alex

-- 
<http://www.alejandro-colomar.es/>
GPG key fingerprint: A9348594CE31283A826FBDD8D57633D441E25BB5