Andrew Geissler | 9b4d8b0 | 2021-02-19 12:26:16 -0600 | [diff] [blame] | 1 | Older seccomp-based filters used in container frameworks will block faccessat2 |
| 2 | calls as it's a relatively new syscall. This isn't a big problem with |
| 3 | glibc <2.33 but 2.33 will call faccessat2 itself, get EPERM, and thenn be confused |
| 4 | about what to do as EPERM isn't an expected error code. |
| 5 | |
| 6 | This manifests itself as mysterious errors, for example a kernel failing to link. |
| 7 | |
| 8 | The root cause of bad seccomp filters is mostly fixed (systemd 247, Docker 20.10.0) |
| 9 | but we can't expect everyone to upgrade, so add a workaound (originally from |
| 10 | Red Hat) to handle EPERM like ENOSYS and fallback to faccessat(). |
| 11 | |
| 12 | Upstream-Status: Inappropriate |
| 13 | Signed-off-by: Ross Burton <ross.burton@arm.com> |
| 14 | |
| 15 | diff --git a/sysdeps/unix/sysv/linux/faccessat.c b/sysdeps/unix/sysv/linux/faccessat.c |
| 16 | index 56cb6dcc8b4d58d3..5de75032bbc93a2c 100644 |
| 17 | --- a/sysdeps/unix/sysv/linux/faccessat.c |
| 18 | +++ b/sysdeps/unix/sysv/linux/faccessat.c |
| 19 | @@ -34,7 +34,11 @@ faccessat (int fd, const char *file, int mode, int flag) |
| 20 | #if __ASSUME_FACCESSAT2 |
| 21 | return ret; |
| 22 | #else |
| 23 | - if (ret == 0 || errno != ENOSYS) |
| 24 | + /* Fedora-specific workaround: |
| 25 | + As a workround for a broken systemd-nspawn that returns |
| 26 | + EPERM when a syscall is not allowed instead of ENOSYS |
| 27 | + we must check for EPERM here and fall back to faccessat. */ |
| 28 | + if (ret == 0 || !(errno == ENOSYS || errno == EPERM)) |
| 29 | return ret; |
| 30 | |
| 31 | if (flag & ~(AT_SYMLINK_NOFOLLOW | AT_EACCESS)) |