everywhere: port everything to sigprocmask_many() and friends

This ports a lot of manual code over to sigprocmask_many() and friends.

Also, we now consistly check for sigprocmask() failures with
assert_se(), since the call cannot realistically fail unless there's a
programming error.

Also encloses a few sd_event_add_signal() calls with (void) when we
ignore the return values for it knowingly.

29 files changed, 61 insertions, 89 deletions

diff --git a/src/basic/signal-util.c b/src/basic/signal-util.c
index 84cf42b285..d24730d439 100644
--- a/src/basic/signal-util.c
+++ b/src/basic/signal-util.c
@@ -159,7 +159,7 @@ int sigset_add_many(sigset_t *ss, ...) {
         return r;
 }
 
-int sigprocmask_many(int how, ...) {
+int sigprocmask_many(int how, sigset_t *old, ...) {
         va_list ap;
         sigset_t ss;
         int r;
@@ -174,7 +174,7 @@ int sigprocmask_many(int how, ...) {
         if (r < 0)
                 return r;
 
-        if (sigprocmask(how, &ss, NULL) < 0)
+        if (sigprocmask(how, &ss, old) < 0)
                 return -errno;
 
         return 0;
diff --git a/src/basic/signal-util.h b/src/basic/signal-util.h
index 9dc8a28726..5e6eb50b07 100644
--- a/src/basic/signal-util.h
+++ b/src/basic/signal-util.h
@@ -33,7 +33,7 @@ int default_signals(int sig, ...);
 int sigaction_many(const struct sigaction *sa, ...);
 
 int sigset_add_many(sigset_t *ss, ...);
-int sigprocmask_many(int how, ...);
+int sigprocmask_many(int how, sigset_t *old, ...);
 
 const char *signal_to_string(int i) _const_;
 int signal_from_string(const char *s) _pure_;
diff --git a/src/console/consoled-manager.c b/src/console/consoled-manager.c
index e560dcf524..20424eb267 100644
--- a/src/console/consoled-manager.c
+++ b/src/console/consoled-manager.c
@@ -51,7 +51,7 @@ int manager_new(Manager **out) {
         if (r < 0)
                 return r;
 
-        r = sigprocmask_many(SIG_BLOCK, SIGTERM, SIGQUIT, SIGINT, SIGWINCH, SIGCHLD, -1);
+        r = sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGQUIT, SIGINT, SIGWINCH, SIGCHLD, -1);
         if (r < 0)
                 return r;
 
diff --git a/src/core/execute.c b/src/core/execute.c
index f13c6936e0..444865da86 100644
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -824,10 +824,7 @@ static int setup_pam(
         /* Block SIGTERM, so that we know that it won't get lost in
          * the child */
 
-        if (sigemptyset(&ss) < 0 ||
-            sigaddset(&ss, SIGTERM) < 0 ||
-            sigprocmask(SIG_BLOCK, &ss, &old_ss) < 0)
-                goto fail;
+        assert_se(sigprocmask_many(SIG_BLOCK, &old_ss, SIGTERM, -1) >= 0);
 
         parent_pid = getpid();
 
@@ -903,8 +900,7 @@ static int setup_pam(
         handle = NULL;
 
         /* Unblock SIGTERM again in the parent */
-        if (sigprocmask(SIG_SETMASK, &old_ss, NULL) < 0)
-                goto fail;
+        assert_se(sigprocmask(SIG_SETMASK, &old_ss, NULL) >= 0);
 
         /* We close the log explicitly here, since the PAM modules
          * might have opened it, but we don't want this fd around. */
diff --git a/src/import/export.c b/src/import/export.c
index e563bee96e..ec7dbe210a 100644
--- a/src/import/export.c
+++ b/src/import/export.c
@@ -118,9 +118,9 @@ static int export_tar(int argc, char *argv[], void *userdata) {
         if (r < 0)
                 return log_error_errno(r, "Failed to allocate event loop: %m");
 
-        assert_se(sigprocmask_many(SIG_BLOCK, SIGTERM, SIGINT, -1) == 0);
-        sd_event_add_signal(event, NULL, SIGTERM, interrupt_signal_handler,  NULL);
-        sd_event_add_signal(event, NULL, SIGINT, interrupt_signal_handler, NULL);
+        assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, -1) >= 0);
+        (void) sd_event_add_signal(event, NULL, SIGTERM, interrupt_signal_handler,  NULL);
+        (void) sd_event_add_signal(event, NULL, SIGINT, interrupt_signal_handler, NULL);
 
         r = tar_export_new(&export, event, on_tar_finished, event);
         if (r < 0)
@@ -197,9 +197,9 @@ static int export_raw(int argc, char *argv[], void *userdata) {
         if (r < 0)
                 return log_error_errno(r, "Failed to allocate event loop: %m");
 
-        assert_se(sigprocmask_many(SIG_BLOCK, SIGTERM, SIGINT, -1) == 0);
-        sd_event_add_signal(event, NULL, SIGTERM, interrupt_signal_handler,  NULL);
-        sd_event_add_signal(event, NULL, SIGINT, interrupt_signal_handler, NULL);
+        assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, -1) >= 0);
+        (void) sd_event_add_signal(event, NULL, SIGTERM, interrupt_signal_handler,  NULL);
+        (void) sd_event_add_signal(event, NULL, SIGINT, interrupt_signal_handler, NULL);
 
         r = raw_export_new(&export, event, on_raw_finished, event);
         if (r < 0)
diff --git a/src/import/import.c b/src/import/import.c
index 3091ed1c45..b7772390e9 100644
--- a/src/import/import.c
+++ b/src/import/import.c
@@ -116,9 +116,9 @@ static int import_tar(int argc, char *argv[], void *userdata) {
         if (r < 0)
                 return log_error_errno(r, "Failed to allocate event loop: %m");
 
-        assert_se(sigprocmask_many(SIG_BLOCK, SIGTERM, SIGINT, -1) == 0);
-        sd_event_add_signal(event, NULL, SIGTERM, interrupt_signal_handler,  NULL);
-        sd_event_add_signal(event, NULL, SIGINT, interrupt_signal_handler, NULL);
+        assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, -1) >= 0);
+        (void) sd_event_add_signal(event, NULL, SIGTERM, interrupt_signal_handler,  NULL);
+        (void) sd_event_add_signal(event, NULL, SIGINT, interrupt_signal_handler, NULL);
 
         r = tar_import_new(&import, event, arg_image_root, on_tar_finished, event);
         if (r < 0)
@@ -211,9 +211,9 @@ static int import_raw(int argc, char *argv[], void *userdata) {
         if (r < 0)
                 return log_error_errno(r, "Failed to allocate event loop: %m");
 
-        assert_se(sigprocmask_many(SIG_BLOCK, SIGTERM, SIGINT, -1) == 0);
-        sd_event_add_signal(event, NULL, SIGTERM, interrupt_signal_handler,  NULL);
-        sd_event_add_signal(event, NULL, SIGINT, interrupt_signal_handler, NULL);
+        assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, -1) >= 0);
+        (void) sd_event_add_signal(event, NULL, SIGTERM, interrupt_signal_handler,  NULL);
+        (void) sd_event_add_signal(event, NULL, SIGINT, interrupt_signal_handler, NULL);
 
         r = raw_import_new(&import, event, arg_image_root, on_raw_finished, event);
         if (r < 0)
diff --git a/src/import/importd.c b/src/import/importd.c
index 05a619ac0c..03aede6016 100644
--- a/src/import/importd.c
+++ b/src/import/importd.c
@@ -1301,7 +1301,7 @@ int main(int argc, char *argv[]) {
                 goto finish;
         }
 
-        assert_se(sigprocmask_many(SIG_BLOCK, SIGCHLD, -1) >= 0);
+        assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGCHLD, -1) >= 0);
 
         r = manager_new(&m);
         if (r < 0) {
diff --git a/src/import/pull.c b/src/import/pull.c
index 03fe3dcaf4..ca33d2f3fa 100644
--- a/src/import/pull.c
+++ b/src/import/pull.c
@@ -109,9 +109,9 @@ static int pull_tar(int argc, char *argv[], void *userdata) {
         if (r < 0)
                 return log_error_errno(r, "Failed to allocate event loop: %m");
 
-        assert_se(sigprocmask_many(SIG_BLOCK, SIGTERM, SIGINT, -1) == 0);
-        sd_event_add_signal(event, NULL, SIGTERM, interrupt_signal_handler,  NULL);
-        sd_event_add_signal(event, NULL, SIGINT, interrupt_signal_handler, NULL);
+        assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, -1) >= 0);
+        (void) sd_event_add_signal(event, NULL, SIGTERM, interrupt_signal_handler,  NULL);
+        (void) sd_event_add_signal(event, NULL, SIGINT, interrupt_signal_handler, NULL);
 
         r = tar_pull_new(&pull, event, arg_image_root, on_tar_finished, event);
         if (r < 0)
@@ -195,9 +195,9 @@ static int pull_raw(int argc, char *argv[], void *userdata) {
         if (r < 0)
                 return log_error_errno(r, "Failed to allocate event loop: %m");
 
-        assert_se(sigprocmask_many(SIG_BLOCK, SIGTERM, SIGINT, -1) == 0);
-        sd_event_add_signal(event, NULL, SIGTERM, interrupt_signal_handler,  NULL);
-        sd_event_add_signal(event, NULL, SIGINT, interrupt_signal_handler, NULL);
+        assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, -1) >= 0);
+        (void) sd_event_add_signal(event, NULL, SIGTERM, interrupt_signal_handler,  NULL);
+        (void) sd_event_add_signal(event, NULL, SIGINT, interrupt_signal_handler, NULL);
 
         r = raw_pull_new(&pull, event, arg_image_root, on_raw_finished, event);
         if (r < 0)
@@ -303,9 +303,9 @@ static int pull_dkr(int argc, char *argv[], void *userdata) {
         if (r < 0)
                 return log_error_errno(r, "Failed to allocate event loop: %m");
 
-        assert_se(sigprocmask_many(SIG_BLOCK, SIGTERM, SIGINT, -1) == 0);
-        sd_event_add_signal(event, NULL, SIGTERM, interrupt_signal_handler,  NULL);
-        sd_event_add_signal(event, NULL, SIGINT, interrupt_signal_handler, NULL);
+        assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, -1) >= 0);
+        (void) sd_event_add_signal(event, NULL, SIGTERM, interrupt_signal_handler,  NULL);
+        (void) sd_event_add_signal(event, NULL, SIGINT, interrupt_signal_handler, NULL);
 
         r = dkr_pull_new(&pull, event, arg_dkr_index_url, arg_image_root, on_dkr_finished, event);
         if (r < 0)
diff --git a/src/journal-remote/journal-remote.c b/src/journal-remote/journal-remote.c
index ae332d826f..1baedf6367 100644
--- a/src/journal-remote/journal-remote.c
+++ b/src/journal-remote/journal-remote.c
@@ -788,14 +788,11 @@ static int dispatch_http_event(sd_event_source *event,
  **********************************************************************/
 
 static int setup_signals(RemoteServer *s) {
-        sigset_t mask;
         int r;
 
         assert(s);
 
-        assert_se(sigemptyset(&mask) == 0);
-        sigset_add_many(&mask, SIGINT, SIGTERM, -1);
-        assert_se(sigprocmask(SIG_SETMASK, &mask, NULL) == 0);
+        assert_se(sigprocmask_many(SIG_SETMASK, NULL, SIGINT, SIGTERM, -1) >= 0);
 
         r = sd_event_add_signal(s->events, &s->sigterm_event, SIGTERM, NULL, s);
         if (r < 0)
diff --git a/src/journal-remote/journal-upload.c b/src/journal-remote/journal-upload.c
index ddb1ef0396..5d23639ee8 100644
--- a/src/journal-remote/journal-upload.c
+++ b/src/journal-remote/journal-upload.c
@@ -396,14 +396,11 @@ static int dispatch_sigterm(sd_event_source *event,
 }
 
 static int setup_signals(Uploader *u) {
-        sigset_t mask;
         int r;
 
         assert(u);
 
-        assert_se(sigemptyset(&mask) == 0);
-        sigset_add_many(&mask, SIGINT, SIGTERM, -1);
-        assert_se(sigprocmask(SIG_SETMASK, &mask, NULL) == 0);
+        assert_se(sigprocmask_many(SIG_SETMASK, NULL, SIGINT, SIGTERM, -1) >= 0);
 
         r = sd_event_add_signal(u->events, &u->sigterm_event, SIGTERM, dispatch_sigterm, u);
         if (r < 0)
diff --git a/src/journal/journald-server.c b/src/journal/journald-server.c
index d0d670f36e..f7402984af 100644
--- a/src/journal/journald-server.c
+++ b/src/journal/journald-server.c
@@ -1264,14 +1264,11 @@ static int dispatch_sigterm(sd_event_source *es, const struct signalfd_siginfo *
 }
 
 static int setup_signals(Server *s) {
-        sigset_t mask;
         int r;
 
         assert(s);
 
-        assert_se(sigemptyset(&mask) == 0);
-        sigset_add_many(&mask, SIGINT, SIGTERM, SIGUSR1, SIGUSR2, -1);
-        assert_se(sigprocmask(SIG_SETMASK, &mask, NULL) == 0);
+        assert(sigprocmask_many(SIG_SETMASK, NULL, SIGINT, SIGTERM, SIGUSR1, SIGUSR2, -1) >= 0);
 
         r = sd_event_add_signal(s->event, &s->sigusr1_event_source, SIGUSR1, dispatch_sigusr1, s);
         if (r < 0)
diff --git a/src/libsystemd-terminal/evcat.c b/src/libsystemd-terminal/evcat.c
index bfa166c489..2aeefc2e16 100644
--- a/src/libsystemd-terminal/evcat.c
+++ b/src/libsystemd-terminal/evcat.c
@@ -154,7 +154,7 @@ static int evcat_new(Evcat **out) {
         if (r < 0)
                 return r;
 
-        r = sigprocmask_many(SIG_BLOCK, SIGTERM, SIGINT, -1);
+        r = sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, -1);
         if (r < 0)
                 return r;
 
diff --git a/src/libsystemd-terminal/modeset.c b/src/libsystemd-terminal/modeset.c
index f3a60e1fb0..790a244772 100644
--- a/src/libsystemd-terminal/modeset.c
+++ b/src/libsystemd-terminal/modeset.c
@@ -170,7 +170,7 @@ static int modeset_new(Modeset **out) {
         if (r < 0)
                 return r;
 
-        r = sigprocmask_many(SIG_BLOCK, SIGTERM, SIGINT, -1);
+        r = sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, -1);
         if (r < 0)
                 return r;
 
diff --git a/src/libsystemd-terminal/subterm.c b/src/libsystemd-terminal/subterm.c
index d10e2f549f..5f12540111 100644
--- a/src/libsystemd-terminal/subterm.c
+++ b/src/libsystemd-terminal/subterm.c
@@ -856,7 +856,7 @@ static int terminal_new(Terminal **out, int in_fd, int out_fd) {
                 goto error;
         }
 
-        r = sigprocmask_many(SIG_BLOCK, SIGINT, SIGQUIT, SIGTERM, SIGWINCH, SIGCHLD, -1);
+        r = sigprocmask_many(SIG_BLOCK, NULL, SIGINT, SIGQUIT, SIGTERM, SIGWINCH, SIGCHLD, -1);
         if (r < 0) {
                 log_error_errno(r, "error: sigprocmask_many() (%d): %m", r);
                 goto error;
diff --git a/src/libsystemd/sd-event/test-event.c b/src/libsystemd/sd-event/test-event.c
index 94e98e0077..408e1679a2 100644
--- a/src/libsystemd/sd-event/test-event.c
+++ b/src/libsystemd/sd-event/test-event.c
@@ -79,7 +79,6 @@ static int child_handler(sd_event_source *s, const siginfo_t *si, void *userdata
 
 static int signal_handler(sd_event_source *s, const struct signalfd_siginfo *si, void *userdata) {
         sd_event_source *p = NULL;
-        sigset_t ss;
         pid_t pid;
 
         assert_se(s);
@@ -89,9 +88,7 @@ static int signal_handler(sd_event_source *s, const struct signalfd_siginfo *si,
 
         assert_se(userdata == INT_TO_PTR('e'));
 
-        assert_se(sigemptyset(&ss) >= 0);
-        assert_se(sigaddset(&ss, SIGCHLD) >= 0);
-        assert_se(sigprocmask(SIG_BLOCK, &ss, NULL) >= 0);
+        assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGCHLD, -1) >= 0);
 
         pid = fork();
         assert_se(pid >= 0);
@@ -109,7 +106,6 @@ static int signal_handler(sd_event_source *s, const struct signalfd_siginfo *si,
 
 static int defer_handler(sd_event_source *s, void *userdata) {
         sd_event_source *p = NULL;
-        sigset_t ss;
 
         assert_se(s);
 
@@ -117,9 +113,8 @@ static int defer_handler(sd_event_source *s, void *userdata) {
 
         assert_se(userdata == INT_TO_PTR('d'));
 
-        assert_se(sigemptyset(&ss) >= 0);
-        assert_se(sigaddset(&ss, SIGUSR1) >= 0);
-        assert_se(sigprocmask(SIG_BLOCK, &ss, NULL) >= 0);
+        assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGUSR1, -1) >= 0);
+
         assert_se(sd_event_add_signal(sd_event_source_get_event(s), &p, SIGUSR1, signal_handler, INT_TO_PTR('e')) >= 0);
         assert_se(sd_event_source_set_enabled(p, SD_EVENT_ONESHOT) >= 0);
         raise(SIGUSR1);
@@ -209,7 +204,7 @@ int main(int argc, char *argv[]) {
         assert_se(sd_event_source_set_prepare(z, prepare_handler) >= 0);
 
         /* Test for floating event sources */
-        assert_se(sigprocmask_many(SIG_BLOCK, SIGRTMIN+1, -1) == 0);
+        assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGRTMIN+1, -1) >= 0);
         assert_se(sd_event_add_signal(e, NULL, SIGRTMIN+1, NULL, NULL) >= 0);
 
         assert_se(write(a[1], &ch, 1) >= 0);
diff --git a/src/login/logind.c b/src/login/logind.c
index 00f8dbdab2..01f7cd9ee0 100644
--- a/src/login/logind.c
+++ b/src/login/logind.c
@@ -787,13 +787,8 @@ static int manager_connect_console(Manager *m) {
                 return -EINVAL;
         }
 
-        r = ignore_signals(SIGRTMIN + 1, -1);
-        if (r < 0)
-                return log_error_errno(r, "Cannot ignore SIGRTMIN + 1: %m");
-
-        r = sigprocmask_many(SIG_BLOCK, SIGRTMIN, -1);
-        if (r < 0)
-                return log_error_errno(r, "Cannot block SIGRTMIN: %m");
+        assert_se(ignore_signals(SIGRTMIN + 1, -1) >= 0);
+        assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGRTMIN, -1) >= 0);
 
         r = sd_event_add_signal(m->event, NULL, SIGRTMIN, manager_vt_switch, m);
         if (r < 0)
diff --git a/src/machine/machinectl.c b/src/machine/machinectl.c
index 719eb10932..7938aa4dbe 100644
--- a/src/machine/machinectl.c
+++ b/src/machine/machinectl.c
@@ -1219,7 +1219,7 @@ static int login_machine(int argc, char *argv[], void *userdata) {
         if (r < 0)
                 return bus_log_parse_error(r);
 
-        sigprocmask_many(SIG_BLOCK, SIGWINCH, SIGTERM, SIGINT, -1);
+        assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGWINCH, SIGTERM, SIGINT, -1) >= 0);
 
         log_info("Connected to machine %s. Press ^] three times within 1s to exit session.", argv[1]);
 
@@ -1630,7 +1630,7 @@ static int transfer_image_common(sd_bus *bus, sd_bus_message *m) {
         if (r < 0)
                 return bus_log_parse_error(r);
 
-        sigprocmask_many(SIG_BLOCK, SIGTERM, SIGINT, -1);
+        assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, -1) >= 0);
 
         if (!arg_quiet)
                 log_info("Enqueued transfer job %u. Press C-c to continue download in background.", id);
diff --git a/src/machine/machined.c b/src/machine/machined.c
index 754c770040..9bfe2add54 100644
--- a/src/machine/machined.c
+++ b/src/machine/machined.c
@@ -322,7 +322,7 @@ int main(int argc, char *argv[]) {
          * check stays in. */
         mkdir_label("/run/systemd/machines", 0755);
 
-        assert_se(sigprocmask_many(SIG_BLOCK, SIGCHLD, -1) >= 0);
+        assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGCHLD, -1) >= 0);
 
         m = manager_new();
         if (!m) {
diff --git a/src/network/networkd-wait-online.c b/src/network/networkd-wait-online.c
index 6a96f1de55..32c31fdf3d 100644
--- a/src/network/networkd-wait-online.c
+++ b/src/network/networkd-wait-online.c
@@ -129,7 +129,7 @@ int main(int argc, char *argv[]) {
         if (arg_quiet)
                 log_set_max_level(LOG_WARNING);
 
-        assert_se(sigprocmask_many(SIG_BLOCK, SIGTERM, SIGINT, -1) == 0);
+        assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, -1) >= 0);
 
         r = manager_new(&m, arg_interfaces, arg_ignore, arg_timeout);
         if (r < 0) {
diff --git a/src/network/networkd.c b/src/network/networkd.c
index 41ec7cf904..9fe8a5fa15 100644
--- a/src/network/networkd.c
+++ b/src/network/networkd.c
@@ -75,7 +75,7 @@ int main(int argc, char *argv[]) {
         if (r < 0)
                 goto out;
 
-        assert_se(sigprocmask_many(SIG_BLOCK, SIGTERM, SIGINT, -1) == 0);
+        assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, -1) >= 0);
 
         r = manager_new(&m);
         if (r < 0) {
diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index c87956bb01..fed77383c3 100644
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -4465,7 +4465,7 @@ int main(int argc, char *argv[]) {
         int r, n_fd_passed, loop_nr = -1;
         char veth_name[IFNAMSIZ];
         bool secondary = false, remove_subvol = false;
-        sigset_t mask, mask_chld;
+        sigset_t mask_chld;
         pid_t pid = 0;
         int ret = EXIT_SUCCESS;
         union in_addr_union exposed = {};
@@ -4664,9 +4664,7 @@ int main(int argc, char *argv[]) {
                 log_info("Spawning container %s on %s.\nPress ^] three times within 1s to kill container.",
                          arg_machine, arg_image ?: arg_directory);
 
-        assert_se(sigemptyset(&mask) == 0);
-        sigset_add_many(&mask, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, -1);
-        assert_se(sigprocmask(SIG_BLOCK, &mask, NULL) == 0);
+        assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, -1) >= 0);
 
         assert_se(sigemptyset(&mask_chld) == 0);
         assert_se(sigaddset(&mask_chld, SIGCHLD) == 0);
diff --git a/src/resolve/resolved.c b/src/resolve/resolved.c
index e283d8a749..0af5545f8e 100644
--- a/src/resolve/resolved.c
+++ b/src/resolve/resolved.c
@@ -71,7 +71,7 @@ int main(int argc, char *argv[]) {
         if (r < 0)
                 goto finish;
 
-        assert_se(sigprocmask_many(SIG_BLOCK, SIGTERM, SIGINT, -1) == 0);
+        assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, -1) >= 0);
 
         r = manager_new(&m);
         if (r < 0) {
diff --git a/src/run/run.c b/src/run/run.c
index f18f77b55a..99d960a664 100644
--- a/src/run/run.c
+++ b/src/run/run.c
@@ -789,19 +789,16 @@ static int start_transient_service(
         if (master >= 0) {
                 _cleanup_(pty_forward_freep) PTYForward *forward = NULL;
                 _cleanup_event_unref_ sd_event *event = NULL;
-                sigset_t mask;
                 char last_char = 0;
 
                 r = sd_event_default(&event);
                 if (r < 0)
                         return log_error_errno(r, "Failed to get event loop: %m");
 
-                assert_se(sigemptyset(&mask) == 0);
-                sigset_add_many(&mask, SIGWINCH, SIGTERM, SIGINT, -1);
-                assert_se(sigprocmask(SIG_BLOCK, &mask, NULL) == 0);
+                assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGWINCH, SIGTERM, SIGINT, -1) >= 0);
 
-                sd_event_add_signal(event, NULL, SIGINT, NULL, NULL);
-                sd_event_add_signal(event, NULL, SIGTERM, NULL, NULL);
+                (void) sd_event_add_signal(event, NULL, SIGINT, NULL, NULL);
+                (void) sd_event_add_signal(event, NULL, SIGTERM, NULL, NULL);
 
                 if (!arg_quiet)
                         log_info("Running as unit %s.\nPress ^] three times within 1s to disconnect TTY.", service);
diff --git a/src/shared/ask-password-api.c b/src/shared/ask-password-api.c
index ef3788be68..3941605cec 100644
--- a/src/shared/ask-password-api.c
+++ b/src/shared/ask-password-api.c
@@ -323,9 +323,9 @@ int ask_password_agent(
 
         assert(_passphrases);
 
-        assert_se(sigemptyset(&mask) == 0);
-        sigset_add_many(&mask, SIGINT, SIGTERM, -1);
-        assert_se(sigprocmask(SIG_BLOCK, &mask, &oldmask) == 0);
+        assert_se(sigemptyset(&mask) >= 0);
+        assert_se(sigset_add_many(&mask, SIGINT, SIGTERM, -1) >= 0);
+        assert_se(sigprocmask(SIG_BLOCK, &mask, &oldmask) >= 0);
 
         mkdir_p_label("/run/systemd/ask-password", 0755);
 
diff --git a/src/test/test-pty.c b/src/test/test-pty.c
index f8807c9150..3f97a64ccd 100644
--- a/src/test/test-pty.c
+++ b/src/test/test-pty.c
@@ -129,7 +129,7 @@ int main(int argc, char *argv[]) {
         log_parse_environment();
         log_open();
 
-        assert_se(sigprocmask_many(SIG_BLOCK, SIGCHLD, -1) >= 0);
+        assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGCHLD, -1) >= 0);
 
         /* Oh, there're ugly races in the TTY layer regarding HUP vs IN. Turns
          * out they appear only 10% of the time. I fixed all of them and
diff --git a/src/test/test-udev.c b/src/test/test-udev.c
index d1fe953071..2b765a3e90 100644
--- a/src/test/test-udev.c
+++ b/src/test/test-udev.c
@@ -116,7 +116,7 @@ int main(int argc, char *argv[]) {
 
         event = udev_event_new(dev);
 
-        assert_se(sigprocmask_many(SIG_BLOCK, SIGTERM, SIGINT, SIGHUP, SIGCHLD, -1) == 0);
+        assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, SIGHUP, SIGCHLD, -1) >= 0);
 
         /* do what devtmpfs usually provides us */
         if (udev_device_get_devnode(dev) != NULL) {
diff --git a/src/timesync/timesyncd.c b/src/timesync/timesyncd.c
index d69129ee03..b030206948 100644
--- a/src/timesync/timesyncd.c
+++ b/src/timesync/timesyncd.c
@@ -117,7 +117,7 @@ int main(int argc, char *argv[]) {
         if (setrlimit(RLIMIT_NPROC, &RLIMIT_MAKE_CONST(2)) < 0)
                 log_warning_errno(errno, "Failed to lower RLIMIT_NPROC to 2: %m");
 
-        assert_se(sigprocmask_many(SIG_BLOCK, SIGTERM, SIGINT, -1) == 0);
+        assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, -1) >= 0);
 
         r = manager_new(&m);
         if (r < 0) {
diff --git a/src/tty-ask-password-agent/tty-ask-password-agent.c b/src/tty-ask-password-agent/tty-ask-password-agent.c
index 97251ef0aa..73b19d8e89 100644
--- a/src/tty-ask-password-agent/tty-ask-password-agent.c
+++ b/src/tty-ask-password-agent/tty-ask-password-agent.c
@@ -485,9 +485,9 @@ static int watch_passwords(void) {
         if (inotify_add_watch(notify, "/run/systemd/ask-password", IN_CLOSE_WRITE|IN_MOVED_TO) < 0)
                 return -errno;
 
-        assert_se(sigemptyset(&mask) == 0);
-        sigset_add_many(&mask, SIGINT, SIGTERM, -1);
-        assert_se(sigprocmask(SIG_SETMASK, &mask, NULL) == 0);
+        assert_se(sigemptyset(&mask) >= 0);
+        assert_se(sigset_add_many(&mask, SIGINT, SIGTERM, -1) >= 0);
+        assert_se(sigprocmask(SIG_SETMASK, &mask, NULL) >= 0);
 
         signal_fd = signalfd(-1, &mask, SFD_NONBLOCK|SFD_CLOEXEC);
         if (signal_fd < 0)
diff --git a/src/udev/udevd.c b/src/udev/udevd.c
index 2b1dbb8bf1..d3797bb5e6 100644
--- a/src/udev/udevd.c
+++ b/src/udev/udevd.c
@@ -1547,7 +1547,7 @@ static int manager_new(Manager **ret, int fd_ctrl, int fd_uevent, const char *cg
         udev_watch_restore(manager->udev);
 
         /* block and listen to all signals on signalfd */
-        assert_se(sigprocmask_many(SIG_BLOCK, SIGTERM, SIGINT, SIGHUP, SIGCHLD, -1) == 0);
+        assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, SIGHUP, SIGCHLD, -1) >= 0);
 
         r = sd_event_default(&manager->event);
         if (r < 0)