diff options
| author |   Ross Burton <ross@burtonini.com> | 2021-02-11 14:46:45 +0000 |
|---|---|---|
| committer |   Richard Purdie <richard.purdie@linuxfoundation.org> | 2021-02-12 23:32:11 +0000 |
| commit | 4d6ad6d611834c2648d6bf9791cb8140967e2529 (patch) | |
| tree | ca91b488ace1eb6b9d873b88888453c8083c45af | |
| parent | 92a9a86df9e3bcffb13d2f8b5dcbe7822170f734 (diff) | |
| download | openembedded-core-4d6ad6d611834c2648d6bf9791cb8140967e2529.tar.gz | |
glibc: add workaround for faccessat2 being blocked by seccomp filtersuninative-3.0
Older seccomp-based filters used in container frameworks will block faccessat2
calls as it's a relatively new syscall. This isn't a big problem with
glibc <2.33 but 2.33 will call faccessat2 itself, get EPERM, and thenn be confused
about what to do as EPERM isn't an expected error code.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
| -rw-r--r-- | meta/recipes-core/glibc/glibc/faccessat2-perm.patch | 31 | ||||
| -rw-r--r-- | meta/recipes-core/glibc/glibc_2.33.bb | 1 |
2 files changed, 32 insertions, 0 deletions
diff --git a/meta/recipes-core/glibc/glibc/faccessat2-perm.patch b/meta/recipes-core/glibc/glibc/faccessat2-perm.patch new file mode 100644 index 0000000000..2ee7110ca1 --- /dev/null +++ b/meta/recipes-core/glibc/glibc/faccessat2-perm.patch @@ -0,0 +1,31 @@ +Older seccomp-based filters used in container frameworks will block faccessat2 +calls as it's a relatively new syscall. This isn't a big problem with +glibc <2.33 but 2.33 will call faccessat2 itself, get EPERM, and thenn be confused +about what to do as EPERM isn't an expected error code. + +This manifests itself as mysterious errors, for example a kernel failing to link. + +The root cause of bad seccomp filters is mostly fixed (systemd 247, Docker 20.10.0) +but we can't expect everyone to upgrade, so add a workaound (originally from +Red Hat) to handle EPERM like ENOSYS and fallback to faccessat(). + +Upstream-Status: Inappropriate +Signed-off-by: Ross Burton <ross.burton@arm.com> + +diff --git a/sysdeps/unix/sysv/linux/faccessat.c b/sysdeps/unix/sysv/linux/faccessat.c +index 56cb6dcc8b4d58d3..5de75032bbc93a2c 100644 +--- a/sysdeps/unix/sysv/linux/faccessat.c ++++ b/sysdeps/unix/sysv/linux/faccessat.c +@@ -34,7 +34,11 @@ faccessat (int fd, const char *file, int mode, int flag) + #if __ASSUME_FACCESSAT2 + return ret; + #else +- if (ret == 0 || errno != ENOSYS) ++ /* Fedora-specific workaround: ++ As a workround for a broken systemd-nspawn that returns ++ EPERM when a syscall is not allowed instead of ENOSYS ++ we must check for EPERM here and fall back to faccessat. */ ++ if (ret == 0 || !(errno == ENOSYS || errno == EPERM)) + return ret; + + if (flag & ~(AT_SYMLINK_NOFOLLOW | AT_EACCESS)) diff --git a/meta/recipes-core/glibc/glibc_2.33.bb b/meta/recipes-core/glibc/glibc_2.33.bb index 4085c779eb..e0002e6046 100644 --- a/meta/recipes-core/glibc/glibc_2.33.bb +++ b/meta/recipes-core/glibc/glibc_2.33.bb @@ -12,6 +12,7 @@ NATIVESDKFIXES_class-nativesdk = "\ file://0005-nativesdk-glibc-Raise-the-size-of-arrays-containing-.patch \ file://0006-nativesdk-glibc-Allow-64-bit-atomics-for-x86.patch \ file://0007-nativesdk-glibc-Make-relocatable-install-for-locales.patch \ + file://faccessat2-perm.patch \ " SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \ |