cleanup(libscap): Allow retries after encountering SCAP_EOF

Call gzclearerr if gzread returns fewer bytes than expected. This lets us "tail" a file being written by another process. Signed-off-by: Gerald Combs <[email protected]>
falcosecurity · May 2, 2024 · 4e61106 · 4e61106
1 parent 1df2a53
commit 4e61106
Showing 1 changed file with 16 additions and 1 deletion.
diff --git a/userspace/libscap/engine/savefile/scap_reader_gzfile.c b/userspace/libscap/engine/savefile/scap_reader_gzfile.c
@@ -26,7 +26,22 @@ typedef struct reader_handle
 static int gzfile_read(scap_reader_t *r, void* buf, uint32_t len)
 {
     ASSERT(r != NULL);
-    return gzread(((reader_handle_t*)r->handle)->m_file, buf, len);
+    int readsize = gzread(((reader_handle_t*)r->handle)->m_file, buf, len);
+
+    if (readsize < (int)len && readsize != -1)
+    {
+        int errnum;
+        gzerror(((reader_handle_t*)r->handle)->m_file, &errnum);
+        if (errnum == Z_OK || errnum == Z_BUF_ERROR)
+        {
+            // We've reached the end of input. This isn't necessarily an
+            // error, e.g. if we're tailing a file that's being written by
+            // another process, so allow for retries.
+            gzclearerr(((reader_handle_t*)r->handle)->m_file);
+        }
+    }
+
+    return readsize;
 }
 
 static int64_t gzfile_offset(scap_reader_t *r)