Seccomp blocks install of "libc6" in Ubuntu 20.04 "focal" image on armhf (arm32v7) #40734
Comments
thaJeztah
added
area/security/seccomp
exp/expert
kind/bug
|
Mentioned by @DeeDeeG on docker/containerd-packaging#151 (comment)
|
|
@AkihiroSuda @justincormack @cpuguy83 @tiborvass I could use some help on this to investigate what needs to be changed (does our default profile needs changing? does libsecomp itself needs a change to understand a new syscall? is this a bug in the package?) |
|
Oh, and perhaps @kolyshkin (as you like working on low-level stuff |
|
If it's indeed related to the |
|
I guess the default profile may need to have some of the new syscalls (added in seccomp/libseccomp@bf747eb) added to the whitelist |
|
Opened a PR to add the 64-bit time_t syscalls to the seccomp profile: #40739 To be looked at:These syscalls are also new (and added to libseccomp in seccomp/libseccomp@bf747eb), but need to be looked at separately
|
|
Changing the profile unfortunately didn't solve the problem: the problem looks to be the libseccomp version. When installing libseccomp 2.4.3, the problem does not reproduce. Unfortunately, that version is not available on Ubuntu versions < 20.03 (https://packages.ubuntu.com/search?keywords=libseccomp2). So for debugging, I installed the package from the ubuntu 20.03 repository. What it comes down to; The container we're running (ubuntu:20.03) makes a syscall that's introduced in Linux 5.x, but docker in this case is running on a 4.x kernel (the host is Ubuntu 16.04). The version of libseccomp installed on the host is not taking kernel 5.x syscalls into account, receives an error, and (likely) in that case blocks the syscall. Solutions for this would be to;
|
|
To reach out to Ubuntu, one can try the I'm not sure where the best point of contact would be for debian... They have this: https://lists.debian.org/debian-devel/ (Seems pretty busy, IMO. But at least most threads get a response.) Edit to add: The individual debian package maintainers for |
|
Given the goal is to get it into both Debian and Ubuntu's stable releases, I'd suggest starting with the Debian package maintainers. They're probably not going to want to do the minor patch bump in stable unless it's just the minimal patch (and the release team will be the final deciders anyhow, and they're typically pretty strict about wanting patches to be minimal unless you've got a really compelling reason to do otherwise), so I'd suggest creating a patch of the absolute bare minimum (which I guess would be either https://github.com/seccomp/libseccomp/commit/bf747eb21e428c2b3ead6ebcca27951b681963a0.patch or more likely https://github.com/seccomp/libseccomp/commit/be65b26b67099be2b2b4890d736dbd1ad15adf36.patch since that's the exact 2.4-backport comimt) and including in your communication that upstream backported it to 2.4 in v2.4.2 (which is where your patch comes from). As for contacting the maintainers, you could try emailing Concurrently, I'd suggest contacting the Ubuntu |
|
@thaJeztah Focal repos have been purged of 2.30 libc6 and the base image used to build ubuntu images comes default with 2.31 now https://partner-images.canonical.com/core/focal/current/ubuntu-focal-core-cloudimg-armhf-root.tar.gz . Now I am running Edit: if you need me to do any testing let me know. |
|
@thaJeztah Actually, I can reproduce this on a host running Ubuntu Focal (20.04) building an Ubuntu Focal docker image with up to date libsseccomp2 (2.4.3-1) on ARMHF. Now, let's try and build the following Dockerfile... Indeed, during the It's not easy to work around because unfortunately |
@thaJeztah @iamthebot Agreed - I also have been able to reproduce this on a Raspi 4B+ running Ubuntu Focal (20.04) building an Ubuntu Focal docker image with up to date libsseccomp2 (2.4.3-1) - kernel was running in 32-bit mode ie. ARMHF.
|
Focal tries to use a new system call that Ubuntu's version of libseccomp doesn't quite support on my build host moby/moby#40734.
|
|
|
@iav Unfortunately, I can't - I'm building using a new Dockerfile and ubuntu:focal as my base image. I'm using |
|
It looks like with the release of Docker 19.03.11 this has been addressed, at least on native hardware running a 5.x kernel. Any notes on the fixes implemented ? Edit: It looks like this fix is comprehensive with this new version of Docker this is no longer an issue even on a host running an old 4.x series kernel. |
@iav running with @thelamer thanks! I think the problem occurred when running a |
|
For anyone else coming here and trying to figure out how to add Enjoy! |
Opening a tracking issue for this for further investigation. More details can be found in:
Summary
Ubuntu 20.04 ("focal") on armhf (arm32) currently has an issue where it looks like seccomp is blocking a syscall that's used when installing libc6:
With seccomp disabled, installing
libc6is succesfulloutput of the above:
With seccomp enabled, installation fails:
output of the above:
Information about the environment
docker version
docker info
Output of `check-config.sh`:
The text was updated successfully, but these errors were encountered: