Older seccomp-based filters used in container frameworks will block faccessat2
calls as it's a relatively new syscall. This isn't a big problem with
glibc <2.33 but 2.33 will call faccessat2 itself, get EPERM, and thenn be
confused
about what to do as EPERM isn't an expected error code.
Signed-off-by: Ross Burton <ross.bur...@arm.com>
---
.../glibc/glibc/faccessat2-perm.patch | 31 +++++++++++++++++++
meta/recipes-core/glibc/glibc_2.33.bb | 1 +
2 files changed, 32 insertions(+)
create mode 100644 meta/recipes-core/glibc/glibc/faccessat2-perm.patch
diff --git a/meta/recipes-core/glibc/glibc/faccessat2-perm.patch
b/meta/recipes-core/glibc/glibc/faccessat2-perm.patch
new file mode 100644
index 0000000000..2ee7110ca1
--- /dev/null
+++ b/meta/recipes-core/glibc/glibc/faccessat2-perm.patch
@@ -0,0 +1,31 @@
+Older seccomp-based filters used in container frameworks will block faccessat2
+calls as it's a relatively new syscall. This isn't a big problem with
+glibc <2.33 but 2.33 will call faccessat2 itself, get EPERM, and thenn be
confused
+about what to do as EPERM isn't an expected error code.
+
+This manifests itself as mysterious errors, for example a kernel failing to
link.
+
+The root cause of bad seccomp filters is mostly fixed (systemd 247, Docker
20.10.0)
+but we can't expect everyone to upgrade, so add a workaound (originally from
+Red Hat) to handle EPERM like ENOSYS and fallback to faccessat().
+
+Upstream-Status: Inappropriate
+Signed-off-by: Ross Burton <ross.bur...@arm.com>
+
+diff --git a/sysdeps/unix/sysv/linux/faccessat.c
b/sysdeps/unix/sysv/linux/faccessat.c
+index 56cb6dcc8b4d58d3..5de75032bbc93a2c 100644
+--- a/sysdeps/unix/sysv/linux/faccessat.c
++++ b/sysdeps/unix/sysv/linux/faccessat.c
+@@ -34,7 +34,11 @@ faccessat (int fd, const char *file, int mode, int flag)
+ #if __ASSUME_FACCESSAT2
+ return ret;
+ #else
+- if (ret == 0 || errno != ENOSYS)
++ /* Fedora-specific workaround:
++ As a workround for a broken systemd-nspawn that returns
++ EPERM when a syscall is not allowed instead of ENOSYS
++ we must check for EPERM here and fall back to faccessat. */
++ if (ret == 0 || !(errno == ENOSYS || errno == EPERM))
+ return ret;
+
+ if (flag & ~(AT_SYMLINK_NOFOLLOW | AT_EACCESS))
diff --git a/meta/recipes-core/glibc/glibc_2.33.bb
b/meta/recipes-core/glibc/glibc_2.33.bb
index 4085c779eb..e0002e6046 100644
--- a/meta/recipes-core/glibc/glibc_2.33.bb
+++ b/meta/recipes-core/glibc/glibc_2.33.bb
@@ -12,6 +12,7 @@ NATIVESDKFIXES_class-nativesdk = "\
file://0005-nativesdk-glibc-Raise-the-size-of-arrays-containing-.patch \
file://0006-nativesdk-glibc-Allow-64-bit-atomics-for-x86.patch \
file://0007-nativesdk-glibc-Make-relocatable-install-for-locales.patch \
+ file://faccessat2-perm.patch \
"
SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
--
2.25.1
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#147952):
https://lists.openembedded.org/g/openembedded-core/message/147952
Mute This Topic: https://lists.openembedded.org/mt/80558829/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
