Bug 2019901

Are you using docker?  If so, then this is a dup of https://github.com/moby/moby/pull/42681

I've reproduced this using docker (version 20.10.5+dfsg1-1+b5 from Debian 11 fwiw) but also podman-3.2.3-0.11.module+el8.4.0+12050+ef972f71.x86_64 on RHEL 8.4 for the host.

RHEL 8.4 podman doesn't have a seccomp profile that works with the newer clone3 syscall used in RHEL 9 binaries.  For now, you need to run it with --security-opt seccomp=unconfined.  This will be addressed in a future RHEL 8 release.

[jwboyer@vader ~]$ podman run -it --rm registry.access.redhat.com/ubi9-beta/ubi-minimal
Trying to pull registry.access.redhat.com/ubi9-beta/ubi-minimal:latest...
Getting image source signatures
Checking if image destination supports signatures
Copying blob de61ad23d5af done  
Copying blob 34e48c21a445 done  
Copying config fcf4fa2ad9 done  
Writing manifest to image destination
Storing signatures
[root@e772e5d6a752 /]# microdnf

(microdnf:12): GLib-ERROR **: 12:55:48.732: file ../glib/gthread-posix.c: line 1338 (g_system_thread_new): error 'Operation not permitted' during 'pthread_create'
Trace/breakpoint trap (core dumped)
[root@e772e5d6a752 /]# exit
exit
[jwboyer@vader ~]$ podman run -it --rm --security-opt seccomp=unconfined registry.access.redhat.com/ubi9-beta/ubi-minimal
[root@654b8a0698cd /]# microdnf 
This is microdnf, which implements subset of `dnf'.
Usage:
  microdnf [OPTION…] COMMAND

Commands:
  upgrade              Upgrade packages
  update               Compatibility alias for the "upgrade" command
  module reset         Reset a module stream
  distro-sync          Upgrade/downgrade packages to match versions in repositories
  dsync                Compatibility alias for the "distro-sync" command
  remove               Remove packages
  reinstall            Reinstall packages
  clean                Remove cached data
  repolist             List repositories
  module enable        Enable a module stream
  download             Download packages
  makecache            Generate the metadata cache
  module disable       Disable a module stream
  repoquery            Search for packages matching keyword
  install              Install packages

Help Options:
  -h, --help                    Show help options

Application Options:
  --assumeno                    Automatically answer no for all questions
  -y, --assumeyes               Automatically answer yes for all questions
  --best                        Try the best available package versions in transactions
  --config=<config file>        Configuration file location
  --disablerepo=ID              Disable repository by an id
  --disableplugin=name          Disable plugins by name
  --enablerepo=ID               Enable repository by an id
  --enableplugin=name           Enable plugins by name
  --nobest                      Do not limit the transaction to the best candidates
  --installroot=PATH            Set install root
  --nodocs                      Install packages without docs
  --noplugins                   Disable loading of plugins
  --refresh                     Set metadata as expired before running the command
  --releasever=RELEASEVER       Override the value of $releasever in config and repo files
  --setopt=<option>=<value>     Override a configuration option (install_weak_deps=0/1, allow_vendor_change=0/1, keepcache=0/1, module_platform_id=<name:stream>, cachedir=<path>, reposdir=<path1>,<path2>,..., tsflags=nodocs/test, varsdir=<path1>,<path2>,..., repo_id.option_name=<value>)

error: No command specified
[root@654b8a0698cd /]#

This appears to affect more than just te clone() syscall. I verified this on a RHEL 7 and RHEL 8 host using the RHEL 9 container image:

[root@rhel7 ~]# podman run -it registry.access.redhat.com/ubi9-beta/ubi bash
[root@e094e2ec5677 /]# curl www.redhat.com
curl: (6) getaddrinfo() thread failed to start



But, this works fine:
[root@rhel7 ~]# podman run -it --security-opt seccomp=unconfined registry.access.redhat.com/ubi9-beta/ubi bash
[root@3416996cb2fe /]# curl www.redhat.com
[root@3416996cb2fe /]#

could you please check how your seccomp profile looks like?

A  seccomp profile, that deals correctly with new syscalls, looks like the following:

$ head -3 /usr/share/containers/seccomp.json
{
	"defaultAction": "SCMP_ACT_ERRNO",
	"defaultErrnoRet": 38,

If there is no defaultErrnoRet, then the runtime uses by default EPERM causing glibc to fail.

After investigation, the Seccomp profile in RHEL's containers/common is not correct; the latest upstream version will return ENOSYS and not EPERM, which will cause libc in the container to assume (correctly) the kernel does not have support for the new syscall and fall back to older syscalls. We'll need this in RHEL 8.x and 9.0 both.

containers-common-1-2.module+el8.5.0+12582+56d94c81 shipped with RHEL 8.5 contains the following seccomp.json config:

# rpm -qf /usr/share/containers/seccomp.json
containers-common-1-2.module+el8.5.0+12582+56d94c81.noarch


# head -n5  /usr/share/containers/seccomp.json 
{
	"defaultAction": "SCMP_ACT_ERRNO",
	"defaultErrnoRet": 38,
	"archMap": [
		{



So I think this is fixed in RHEL 8 already.  Users just need to update.  Someone will need to check RHEL 9 containers-common.

RHEL 9 Beta ships containers-common-1-2.module+el9.0.0+12467+378c8264 which ships this seccomp.json:  

# rpm2cpio ../containers-common-1-2.module+el9.0.0+12467+378c8264.noarch.rpm | cpio -id
480 blocks

# head -n5 ./usr/share/containers/seccomp.json 
{
	"defaultAction": "SCMP_ACT_ERRNO",
	"defaultErrnoRet": 38,
	"archMap": [
		{

@jnovy can you verify the containers-common that's we're pointing at RHEL 9 and 8.6 when you get a chance please?

Derrick or Tom, 
I tried to write some docText. Can you check it please? 
Many thanks.

The seccomp.json rules were fixed in the way that the profile is not delivered from the main upstream branch of c/common but the oldest vendored version of c/common in podman, skopeo and buildah:

http://pkgs.devel.redhat.com/cgit/rpms/containers-common/commit/?h=stream-container-tools-rhel8-rhel-8.6.0&id=d0c5f615fa52a6edcc8e8356cfd0e2113c63e433
http://pkgs.devel.redhat.com/cgit/rpms/containers-common/commit/?h=rhel-9.0.0&id=d9fd99ed3d5e1b732b8c0db2e73ee61373ea30d4

I can reproduce this issue when building UBI9-based images in CircleCI docker runtime, the output is:

```
Step 7/28 : RUN microdnf -y install tar gzip && tar -zxf /bundle.tar.gz
 ---> Running in 13ccd336fe4f

(microdnf:8): GLib-ERROR **: 23:33:11.649: file ../glib/gthread-posix.c: line 1338 (g_system_thread_new): error 'Operation not permitted' during 'pthread_create'
The command '/bin/sh -c microdnf -y install tar gzip && tar -zxf /bundle.tar.gz' returned a non-zero code: 133
make: *** [Makefile:187: scanner-image] Error 133
```

The build runtime information:

```
Build-agent version 1.0.123804-6379e05c (2022-05-18T21:49:50+0000)
System information:
 Server Version: 20.10.15
 Storage Driver: overlay2
  Backing Filesystem: xfs
 Cgroup Driver: cgroupfs
 Cgroup Version: 1
 Kernel Version: 5.13.0-1021-aws
 Operating System: Ubuntu 20.04.4 LTS
 OSType: linux
 Architecture: x86_64
```