[CWS] ebpfless: fix open ret == 0 case (#27886)

DataDog · Jul 24, 2024 · 143fa1d · 143fa1d
1 parent a6f2368
commit 143fa1d
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/pkg/security/ptracer/fim_handlers.go b/pkg/security/ptracer/fim_handlers.go
@@ -1173,7 +1173,7 @@ func handleNameToHandleAtRet(tracer *Tracer, process *Process, msg *ebpfless.Sys
 }
 
 func handleOpensRet(tracer *Tracer, process *Process, msg *ebpfless.SyscallMsg, regs syscall.PtraceRegs, _ bool) error {
-	if ret := tracer.ReadRet(regs); msg.Open != nil && ret > 0 {
+	if ret := tracer.ReadRet(regs); msg.Open != nil && ret >= 0 {
 		process.Res.Fd[int32(ret)] = msg.Open.Filename
 	}
 	return nil