Skip to content

integration: verify syscall compatibility after seccomp enforcement#5015

Closed
lifubang wants to merge 1 commit intoopencontainers:mainfrom
lifubang:openat2
Closed

integration: verify syscall compatibility after seccomp enforcement#5015
lifubang wants to merge 1 commit intoopencontainers:mainfrom
lifubang:openat2

Conversation

@lifubang
Copy link
Copy Markdown
Member

@lifubang lifubang commented Nov 14, 2025 •
edited by cyphar
Loading

(This PR requires #5026.)

test #5007
Although we need more information in #5007, we can already confirm that there may be a bug in syscall compatibility after seccomp enforcement.

@lifubang
Copy link
Copy Markdown
Member Author

lifubang commented Nov 14, 2025

As expected, the following error was observed:

not ok 267 runc run [seccomp] (verify syscall compatibility after seccomp enforcement)
# (in test file tests/integration/seccomp.bats, line 199)
#   `[ "$status" -eq 0 ]' failed
# runc spec (status=0)
#
# runc run test_busybox (status=1)
# time="2025-11-14T03:57:40Z" level=error msg="runc run failed: unable to start container process: error during container init: error closing exec fds: get handle to /proc/thread-self/fd: unsafe procfs detected: openat2 fsmount:fscontext:proc/thread-self/fd/: function not implemented"
# --- teardown ---

@lifubang
Copy link
Copy Markdown
Member Author

lifubang commented Nov 14, 2025

However, I don’t believe the high-level runtime would set this seccomp configuration: "errnoRet": 38.

@cyphar
Copy link
Copy Markdown
Member

cyphar commented Nov 14, 2025

Well, we actually would prefer higher-level runtimes to set defaultErrno to be 38 (podman does this). See moby/moby#42871 and the surrounding issues.

@cyphar cyphar mentioned this pull request Nov 14, 2025
Closed
@lifubang lifubang added this to the 1.3.4 milestone Nov 14, 2025
@lifubang
integration: verify syscall compatibility after seccomp enforcement
7ae9dd2 
Signed-off-by: lifubang <lifubang@acmcoder.com>
@cyphar
Copy link
Copy Markdown
Member

cyphar commented Nov 20, 2025

This requires the filepath-securejoin update from #5026 as well.

@lifubang
Copy link
Copy Markdown
Member Author

lifubang commented Nov 20, 2025

This requires the filepath-securejoin update from #5026 as well.

I think we can include this PR in #5026. WDYT?

@cyphar
Copy link
Copy Markdown
Member

cyphar commented Nov 20, 2025

Yeah that's probably easiest solution. Thanks @lifubang.

@lifubang lifubang mentioned this pull request Nov 20, 2025
Merged
@lifubang
Copy link
Copy Markdown
Member Author

lifubang commented Nov 20, 2025

Close via #5026

@lifubang lifubang closed this Nov 20, 2025
@lifubang lifubang removed this from the 1.3.4 milestone Nov 26, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

kind/bug

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@lifubang @cyphar