| From a8bc44936202692edcd82a48c07d7cf27d6ed8ee Mon Sep 17 00:00:00 2001 |
| From: Hongxu Jia <hongxu.jia@windriver.com> |
| Date: Sun, 29 Aug 2021 20:49:16 +0800 |
| Subject: [PATCH] fix create thread failed in unprivileged process [BZ #28287] |
| |
| Since commit [d8ea0d0168 Add an internal wrapper for clone, clone2 and clone3] |
| applied, start a unprivileged container (docker run without --privileged), |
| it creates a thread failed in container. |
| |
| In commit d8ea0d0168, it calls __clone3 if HAVE_CLONE3_WAPPER is defined. If |
| __clone3 returns -1 with ENOSYS, fall back to clone or clone2. |
| |
| As known from [1], cloneXXX fails with EPERM if CLONE_NEWCGROUP, |
| CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, or CLONE_NEWUTS |
| was specified by an unprivileged process (process without CAP_SYS_ADMIN) |
| |
| [1] https://man7.org/linux/man-pages/man2/clone3.2.html |
| |
| So if __clone3 returns -1 with EPERM, fall back to clone or clone2 could |
| fix the issue. Here are the test steps: |
| |
| 1) Prepare test code |
| cat > conftest.c <<ENDOF |
| #include <pthread.h> |
| #include <stdio.h> |
| |
| int check_me = 0; |
| void* func(void* data) {check_me = 42; printf("start thread: check_me %d\n", check_me); return &check_me;} |
| int main() |
| { |
| pthread_t t; |
| void *ret; |
| pthread_create (&t, 0, func, 0); |
| pthread_join (t, &ret); |
| printf("check_me %d, p %p\n", check_me, &ret); |
| return (check_me != 42 || ret != &check_me); |
| } |
| |
| ENDOF |
| |
| 2) Compile |
| gcc -o conftest -pthread conftest.c |
| |
| 3) Start a container with glibc 2.34 installed |
| [skip details] |
| docker run -it <container-image-name> bash |
| |
| 4) Run conftest without this patch |
| $ ./conftest |
| check_me 0, p 0x7ffd91ccd400 |
| |
| 5) Run conftest with this patch |
| $ ./conftest |
| start thread: check_me 42 |
| check_me 42, p 0x7ffe253c6f20 |
| |
| Upstream-Status: Submitted [libc-alpha@sourceware.org] |
| |
| Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> |
| --- |
| sysdeps/unix/sysv/linux/clone-internal.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/sysdeps/unix/sysv/linux/clone-internal.c b/sysdeps/unix/sysv/linux/clone-internal.c |
| index 979f7880be..97101994e8 100644 |
| --- a/sysdeps/unix/sysv/linux/clone-internal.c |
| +++ b/sysdeps/unix/sysv/linux/clone-internal.c |
| @@ -52,7 +52,7 @@ __clone_internal (struct clone_args *cl_args, |
| /* Try clone3 first. */ |
| int saved_errno = errno; |
| ret = __clone3 (cl_args, sizeof (*cl_args), func, arg); |
| - if (ret != -1 || errno != ENOSYS) |
| + if (ret != -1 || (errno != ENOSYS && errno != EPERM)) |
| return ret; |
| |
| /* NB: Restore errno since errno may be checked against non-zero |
| -- |
| 2.30.2 |
| |