diff --git a/lib/seccomp-tools/dumper.rb b/lib/seccomp-tools/dumper.rb index 821bf79..fd711a9 100644 --- a/lib/seccomp-tools/dumper.rb +++ b/lib/seccomp-tools/dumper.rb @@ -181,7 +181,11 @@ def dump_by_pid(pid, limit, &block) while limit.negative? || i < limit begin bpf = Ptrace.seccomp_get_filter(pid, i) - rescue Errno::ENOENT, Errno::EINVAL + rescue Errno::EINVAL + Logger.error('No seccomp filters installed') + break + rescue Errno::ENOENT + Logger.error('No filter exists at this index') break end collect << (block.nil? ? bpf : yield(bpf, nil)) diff --git a/spec/cli/dump_spec.rb b/spec/cli/dump_spec.rb index d55327e..5ad9989 100644 --- a/spec/cli/dump_spec.rb +++ b/spec/cli/dump_spec.rb @@ -34,11 +34,22 @@ break if line.start_with?('Welcome') end expect { described_class.new(['-f', 'inspect', '-p', pid.to_s]).handle }.to output(@bpf_inspect).to_stdout - expect { described_class.new(['-l', '2', '-p', pid.to_s]).handle }.to output(@bpf_disasm).to_stdout + expect { described_class.new(['-l', '2', '-p', pid.to_s]).handle }.to output(@bpf_disasm+"[ERROR] No filter exists at this index\n").to_stdout i.write("0\n") end end + it 'by pid without filter' do + pid = Process.spawn('sleep 60') + begin + error = /No seccomp filters installed/ + expect { described_class.new(['-p', pid.to_s]).handle }.to output(error).to_stdout + ensure + Process.kill('TERM', pid) + Process.wait(pid) + end + end + it 'by pid without root' do pid = Process.spawn('sleep 60') begin