syscalls: do not conceal BPF_PROG_* syscall errors

The error wrapping code for BPF_PROG_* syscall-related errors would mask
the true source of all underlying syscall errors, which meant that you
couldn't detect several fairly important cases (such as -EACESS and
-EPERM). It seems that this behaviour wasn't intentional (prior to
commit de57e91, the behaviour was to bubble up the syscall error)
and the similar wrapping of BPF_MAP_* errors did bubble up the syscall
error to.

This is needed for runc to be able to detect permission errors due to
SELinux labels blocking certain operations (mainly NewProgramFromID),
and unifies the behaviour for BPF_PROG_* and BPF_MAP_* syscalls.

Fixes: de57e91 ("Add *GetNextID")
Signed-off-by: Aleksa Sarai <[email protected]>

syscalls.go

@@ -357,10 +357,9 @@ func wrapObjError(err error) error {
 		return nil
 	}
 	if errors.Is(err, unix.ENOENT) {
-		return fmt.Errorf("%w", ErrNotExist)
+		return ErrNotExist
 	}
-
-	return errors.New(err.Error())
+	return err
 }
 
 func wrapMapError(err error) error {