From 143fa1d5301a09fb2e0acd8f1948c3d0c1f7bc44 Mon Sep 17 00:00:00 2001
From: Paul Cacheux <paul.cacheux@datadoghq.com>
Date: Wed, 24 Jul 2024 10:00:44 +0200
Subject: [PATCH] [CWS] ebpfless: fix open ret == 0 case (#27886)

---
 pkg/security/ptracer/fim_handlers.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/security/ptracer/fim_handlers.go b/pkg/security/ptracer/fim_handlers.go
index 61cdf8f035eee..c3aeded37ee2d 100644
--- a/pkg/security/ptracer/fim_handlers.go
+++ b/pkg/security/ptracer/fim_handlers.go
@@ -1173,7 +1173,7 @@ func handleNameToHandleAtRet(tracer *Tracer, process *Process, msg *ebpfless.Sys
 }
 
 func handleOpensRet(tracer *Tracer, process *Process, msg *ebpfless.SyscallMsg, regs syscall.PtraceRegs, _ bool) error {
-	if ret := tracer.ReadRet(regs); msg.Open != nil && ret > 0 {
+	if ret := tracer.ReadRet(regs); msg.Open != nil && ret >= 0 {
 		process.Res.Fd[int32(ret)] = msg.Open.Filename
 	}
 	return nil