Bug 1908281

Summary: libseccomp: Add support for newer system calls (up to Linux 5.10)
Product: Red Hat Enterprise Linux 7 Reporter: Florian Weimer <fweimer>
Component: libseccompAssignee: Zoltan Fridrich <zfridric>
Status: CLOSED WONTFIX QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 7.9CC: dapospis, hhorak, jnovy, jpazdziora, kdudka, laurent.rineau__fedora, leiwang, lvrabec, mbasti, rsroka, savsingh, twaugh, v.podzimek+fedora, yann
Target Milestone: rcKeywords: Reopened, Triaged
Target Release: ---Flags: pm-rhel: mirror+
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-08-10 12:34:39 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Florian Weimer 2020-12-16 10:07:53 UTC
Description of problem:

Due to the way various container runtimes set up seccomp filters, libseccomp needs to be updated for new system calls even though the host kernel does not support them. Otherwise, it is not possible to produce an ENOSYS error for them.

Version-Release number of selected component (if applicable):

libseccomp-2.3.1-4.el7.x86_64

How reproducible:

Always.

Steps to Reproduce:

Install Docker CE, in these package versions:

  containerd.io-1.4.3-3.1.el7.x86_64
  libseccomp-2.3.1-4.el7.x86_64
  docker-ce-rootless-extras-20.10.1-3.el7.x86_64
  docker-ce-20.10.1-3.el7.x86_64
  docker-ce-cli-20.10.1-3.el7.x86_64
  container-selinux-2.119.2-1.911c772.el7_8.noarch

This version has faccessat2 support on the Docker CE side.

Then run:

docker run fedora:rawhide /bin/bash -c "yum update -y glibc; bash -c 'test -r /tmp; echo \$?'"

Quoting is a bit tricky here. The inner bash is needed to pick up the new glibc.

Actual results:

1

(faccessat2 return EPERM.)

Expected results:

0

(faccessat2 return ENOSYS, and faccessat fallback is used.)


Additional info:

I rebuild libseccomp 2.5.1 from the upstream sources and verified that it fixes the seccomp filters. But knowledge of the new system calls can likely be backported separately.

Comment 1 Honza Horak 2021-01-11 17:10:20 UTC
Hitting that with mariadb 10.5 in F34 container: bz #1914984

Comment 2 Florian Weimer 2021-01-29 13:14:52 UTC
This runc pull request may make a libseccomp unnecessary (if incorporated into Docker): https://github.com/opencontainers/runc/pull/2750

Comment 4 Zoltan Fridrich 2021-03-18 10:24:05 UTC
As it seems that there is no more need to add new syscalls to libseccomp on rhel-7.9, I will close this bz. However, it can be reopened if needed in the future.

Comment 5 Vratislav Podzimek 2021-05-04 21:00:22 UTC
Please note that this also happens with buildah:

$ c=$(buildah from fedora:34)
$ buildah run $c /bin/bash
# test -x /
# echo $?
1
# exit

Comment 11 Florian Weimer 2021-08-10 12:36:00 UTC
Fedora has encountered this issue as well (or perhaps a closely related one): https://pagure.io/fedora-infrastructure/issue/10145