Patrick Williams | 92b42cb | 2022-09-03 06:53:57 -0500 | [diff] [blame^] | 1 | From ffbb37732807e180b14a21d1bf79ad5038252c02 Mon Sep 17 00:00:00 2001 |
| 2 | From: Hongxu Jia <hongxu.jia@windriver.com> |
| 3 | Date: Sun, 29 Aug 2021 20:49:16 +0800 |
| 4 | Subject: [PATCH] fix create thread failed in unprivileged process [BZ #28287] |
| 5 | |
| 6 | Since commit [d8ea0d0168 Add an internal wrapper for clone, clone2 and clone3] |
| 7 | applied, start a unprivileged container (docker run without --privileged), |
| 8 | it creates a thread failed in container. |
| 9 | |
| 10 | In commit d8ea0d0168, it calls __clone3 if HAVE_CLONE3_WAPPER is defined. If |
| 11 | __clone3 returns -1 with ENOSYS, fall back to clone or clone2. |
| 12 | |
| 13 | As known from [1], cloneXXX fails with EPERM if CLONE_NEWCGROUP, |
| 14 | CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, or CLONE_NEWUTS |
| 15 | was specified by an unprivileged process (process without CAP_SYS_ADMIN) |
| 16 | |
| 17 | [1] https://man7.org/linux/man-pages/man2/clone3.2.html |
| 18 | |
| 19 | So if __clone3 returns -1 with EPERM, fall back to clone or clone2 could |
| 20 | fix the issue. Here are the test steps: |
| 21 | |
| 22 | 1) Prepare test code |
| 23 | cat > conftest.c <<ENDOF |
| 24 | #include <pthread.h> |
| 25 | #include <stdio.h> |
| 26 | |
| 27 | int check_me = 0; |
| 28 | void* func(void* data) {check_me = 42; printf("start thread: check_me %d\n", check_me); return &check_me;} |
| 29 | int main() |
| 30 | { |
| 31 | pthread_t t; |
| 32 | void *ret; |
| 33 | pthread_create (&t, 0, func, 0); |
| 34 | pthread_join (t, &ret); |
| 35 | printf("check_me %d, p %p\n", check_me, &ret); |
| 36 | return (check_me != 42 || ret != &check_me); |
| 37 | } |
| 38 | |
| 39 | ENDOF |
| 40 | |
| 41 | 2) Compile |
| 42 | gcc -o conftest -pthread conftest.c |
| 43 | |
| 44 | 3) Start a container with glibc 2.34 installed |
| 45 | [skip details] |
| 46 | docker run -it <container-image-name> bash |
| 47 | |
| 48 | 4) Run conftest without this patch |
| 49 | $ ./conftest |
| 50 | check_me 0, p 0x7ffd91ccd400 |
| 51 | |
| 52 | 5) Run conftest with this patch |
| 53 | $ ./conftest |
| 54 | start thread: check_me 42 |
| 55 | check_me 42, p 0x7ffe253c6f20 |
| 56 | |
| 57 | Upstream-Status: Inappropriate [Rejected by upstream] |
| 58 | |
| 59 | Upstream glibc rejected it because the latest docker has resolved the issue [1], |
| 60 | and upstream glibc does not backward compatibility with old docker[2] |
| 61 | |
| 62 | In order to build Yocto with uninative in old docker, we need this local |
| 63 | patch |
| 64 | |
| 65 | [1] https://github.com/moby/moby/commit/9f6b562dd12ef7b1f9e2f8e6f2ab6477790a6594 |
| 66 | [2] https://sourceware.org/pipermail/libc-alpha/2021-August/130590.html |
| 67 | |
| 68 | Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> |
| 69 | Signed-off-by: Khem Raj <raj.khem@gmail.com> |
| 70 | --- |
| 71 | sysdeps/unix/sysv/linux/clone-internal.c | 2 +- |
| 72 | 1 file changed, 1 insertion(+), 1 deletion(-) |
| 73 | |
| 74 | diff --git a/sysdeps/unix/sysv/linux/clone-internal.c b/sysdeps/unix/sysv/linux/clone-internal.c |
| 75 | index a71effcbd3..a0569113aa 100644 |
| 76 | --- a/sysdeps/unix/sysv/linux/clone-internal.c |
| 77 | +++ b/sysdeps/unix/sysv/linux/clone-internal.c |
| 78 | @@ -52,7 +52,7 @@ __clone_internal (struct clone_args *cl_args, |
| 79 | /* Try clone3 first. */ |
| 80 | int saved_errno = errno; |
| 81 | ret = __clone3 (cl_args, sizeof (*cl_args), func, arg); |
| 82 | - if (ret != -1 || errno != ENOSYS) |
| 83 | + if (ret != -1 || (errno != ENOSYS && errno != EPERM)) |
| 84 | return ret; |
| 85 | |
| 86 | /* NB: Restore errno since errno may be checked against non-zero |