From 1bf0d628281f33693a1f6c6e156b0c258eee929e Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Mon, 16 Nov 2020 23:07:56 +0200 Subject: [PATCH] Azure CI: use PPA to provide newer libseccomp version Linux 5.8 made faccessat2() system call available in August 2020. This system call is used now by GNU libc to implement more precisely faccessat() system call. GNU glibc does compile-time check for the kernel version and uses faccessat2() unconditionally in case it is available. If kernel responds with ENOSYS error code, GNU libc will attempt to use older, less flexible, faccessat(() system call. When running on a system where libseccomp does not know about the new syscall, the default action in seccomp filters in Docker and other container runtimes is to respond with EPERM error code. This breaks GNU libc's implementation of the faccessat() function -- as well as other newer syscall implementations (e.g. statx()). libseccomp started to support faccessat2() in July 2020 with https://github.com/seccomp/libseccomp/commit/5696c896409c1feb37eb502df33cf36efb2e8e01 (version 2.5.0: https://github.com/seccomp/libseccomp/releases/tag/v2.5.0) With Ubuntu 20.04 as a host, use PPA abbra/freeipa-libseccomp which provides libseccomp 2.5.0 rebuild from Debian Sid. Signed-off-by: Alexander Bokovoy Reviewed-By: Rob Crittenden --- ipatests/azure/Dockerfiles/seccomp.json | 1 + ipatests/azure/templates/test-jobs.yml | 6 +++++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/ipatests/azure/Dockerfiles/seccomp.json b/ipatests/azure/Dockerfiles/seccomp.json index c269d92e5..d5a5631fa 100644 --- a/ipatests/azure/Dockerfiles/seccomp.json +++ b/ipatests/azure/Dockerfiles/seccomp.json @@ -90,6 +90,7 @@ "exit", "exit_group", "faccessat", + "faccessat2", "fadvise64", "fadvise64_64", "fallocate", diff --git a/ipatests/azure/templates/test-jobs.yml b/ipatests/azure/templates/test-jobs.yml index 4f9abf394..1ccf907fe 100644 --- a/ipatests/azure/templates/test-jobs.yml +++ b/ipatests/azure/templates/test-jobs.yml @@ -12,7 +12,11 @@ steps: moreutils \ rng-tools \ systemd-coredump \ - python3-docker + python3-docker \ + software-properties-common + sudo add-apt-repository -y ppa:abbra/freeipa-libseccomp + sudo apt-get update + sudo apt-get install -y libseccomp2 # ubuntu's one is too old: different API python3 -m pip install docker --user displayName: Install Host's tests requirements