diff options
author | Hongxu Jia <hongxu.jia@windriver.com> | 2021-08-29 06:52:35 -0700 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2021-08-31 20:51:11 +0100 |
commit | 40305d389e8a8d19f4b98cf4d36213fdf281e5b3 (patch) | |
tree | 77f071ec309eb8b758e2148258e1ccbb1a6a5c70 /meta/recipes-core/glibc/glibc | |
parent | a5b257006b2c480d86e09909cdafb3c8ba05b863 (diff) | |
download | poky-40305d389e8a8d19f4b98cf4d36213fdf281e5b3.tar.gz |
glibc: fix create thread failed in unprivileged process
Since upstream commit [d8ea0d0168 Add an internal wrapper for clone, clone2
and clone3] applied, start a unprivileged container (docker run without
--privileged), it creates a thread failed in container.
In commit d8ea0d0168, it calls __clone3 if HAVE_CLONE3_WAPPER is defined. If
__clone3 returns -1 with ENOSYS, fall back to clone or clone2.
As known from [1], cloneXXX fails with EPERM if CLONE_NEWCGROUP,
CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, or CLONE_NEWUTS
was specified by an unprivileged process (process without CAP_SYS_ADMIN)
[1] https://man7.org/linux/man-pages/man2/clone3.2.html
So if __clone3 returns -1 with EPERM, fall back to clone or clone2 could
fix the issue.
(From OE-Core rev: 234a3e84640c1bb6df5fa4d3d7089a854b19d108)
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-core/glibc/glibc')
-rw-r--r-- | meta/recipes-core/glibc/glibc/0001-fix-create-thread-failed-in-unprivileged-process-BZ-.patch | 79 |
1 files changed, 79 insertions, 0 deletions
diff --git a/meta/recipes-core/glibc/glibc/0001-fix-create-thread-failed-in-unprivileged-process-BZ-.patch b/meta/recipes-core/glibc/glibc/0001-fix-create-thread-failed-in-unprivileged-process-BZ-.patch new file mode 100644 index 0000000000..3283dd7ad8 --- /dev/null +++ b/meta/recipes-core/glibc/glibc/0001-fix-create-thread-failed-in-unprivileged-process-BZ-.patch | |||
@@ -0,0 +1,79 @@ | |||
1 | From a8bc44936202692edcd82a48c07d7cf27d6ed8ee Mon Sep 17 00:00:00 2001 | ||
2 | From: Hongxu Jia <hongxu.jia@windriver.com> | ||
3 | Date: Sun, 29 Aug 2021 20:49:16 +0800 | ||
4 | Subject: [PATCH] fix create thread failed in unprivileged process [BZ #28287] | ||
5 | |||
6 | Since commit [d8ea0d0168 Add an internal wrapper for clone, clone2 and clone3] | ||
7 | applied, start a unprivileged container (docker run without --privileged), | ||
8 | it creates a thread failed in container. | ||
9 | |||
10 | In commit d8ea0d0168, it calls __clone3 if HAVE_CLONE3_WAPPER is defined. If | ||
11 | __clone3 returns -1 with ENOSYS, fall back to clone or clone2. | ||
12 | |||
13 | As known from [1], cloneXXX fails with EPERM if CLONE_NEWCGROUP, | ||
14 | CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, or CLONE_NEWUTS | ||
15 | was specified by an unprivileged process (process without CAP_SYS_ADMIN) | ||
16 | |||
17 | [1] https://man7.org/linux/man-pages/man2/clone3.2.html | ||
18 | |||
19 | So if __clone3 returns -1 with EPERM, fall back to clone or clone2 could | ||
20 | fix the issue. Here are the test steps: | ||
21 | |||
22 | 1) Prepare test code | ||
23 | cat > conftest.c <<ENDOF | ||
24 | #include <pthread.h> | ||
25 | #include <stdio.h> | ||
26 | |||
27 | int check_me = 0; | ||
28 | void* func(void* data) {check_me = 42; printf("start thread: check_me %d\n", check_me); return &check_me;} | ||
29 | int main() | ||
30 | { | ||
31 | pthread_t t; | ||
32 | void *ret; | ||
33 | pthread_create (&t, 0, func, 0); | ||
34 | pthread_join (t, &ret); | ||
35 | printf("check_me %d, p %p\n", check_me, &ret); | ||
36 | return (check_me != 42 || ret != &check_me); | ||
37 | } | ||
38 | |||
39 | ENDOF | ||
40 | |||
41 | 2) Compile | ||
42 | gcc -o conftest -pthread conftest.c | ||
43 | |||
44 | 3) Start a container with glibc 2.34 installed | ||
45 | [skip details] | ||
46 | docker run -it <container-image-name> bash | ||
47 | |||
48 | 4) Run conftest without this patch | ||
49 | $ ./conftest | ||
50 | check_me 0, p 0x7ffd91ccd400 | ||
51 | |||
52 | 5) Run conftest with this patch | ||
53 | $ ./conftest | ||
54 | start thread: check_me 42 | ||
55 | check_me 42, p 0x7ffe253c6f20 | ||
56 | |||
57 | Upstream-Status: Submitted [libc-alpha@sourceware.org] | ||
58 | |||
59 | Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> | ||
60 | --- | ||
61 | sysdeps/unix/sysv/linux/clone-internal.c | 2 +- | ||
62 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
63 | |||
64 | diff --git a/sysdeps/unix/sysv/linux/clone-internal.c b/sysdeps/unix/sysv/linux/clone-internal.c | ||
65 | index 979f7880be..97101994e8 100644 | ||
66 | --- a/sysdeps/unix/sysv/linux/clone-internal.c | ||
67 | +++ b/sysdeps/unix/sysv/linux/clone-internal.c | ||
68 | @@ -52,7 +52,7 @@ __clone_internal (struct clone_args *cl_args, | ||
69 | /* Try clone3 first. */ | ||
70 | int saved_errno = errno; | ||
71 | ret = __clone3 (cl_args, sizeof (*cl_args), func, arg); | ||
72 | - if (ret != -1 || errno != ENOSYS) | ||
73 | + if (ret != -1 || (errno != ENOSYS && errno != EPERM)) | ||
74 | return ret; | ||
75 | |||
76 | /* NB: Restore errno since errno may be checked against non-zero | ||
77 | -- | ||
78 | 2.30.2 | ||
79 | |||