summaryrefslogtreecommitdiffstats
path: root/meta/recipes-core
diff options
context:
space:
mode:
authorHongxu Jia <hongxu.jia@windriver.com>2022-02-15 18:54:29 -0800
committerRichard Purdie <richard.purdie@linuxfoundation.org>2022-02-18 11:47:26 +0000
commit820f793c709fb2d4ab22688c2eec942d3be54a6b (patch)
treea445e14c933a74bcfdfd008c3f1a00c02c890f47 /meta/recipes-core
parent3858855d0d9cdabc605eab76111494219624be84 (diff)
downloadpoky-820f793c709fb2d4ab22688c2eec942d3be54a6b.tar.gz
glibc: fix create thread failed in unprivileged process
Since upstream commit [d8ea0d0168 Add an internal wrapper for clone, clone2 and clone3] applied, start a unprivileged container (docker run without --privileged), it creates a thread failed in container. In commit d8ea0d0168, it calls __clone3 if HAVE_CLONE3_WAPPER is defined. If __clone3 returns -1 with ENOSYS, fall back to clone or clone2. As known from [1], cloneXXX fails with EPERM if CLONE_NEWCGROUP, CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, or CLONE_NEWUTS was specified by an unprivileged process (process without CAP_SYS_ADMIN) [1] https://man7.org/linux/man-pages/man2/clone3.2.html So if __clone3 returns -1 with EPERM, fall back to clone or clone2 could fix the issue. (From OE-Core rev: 58802b2c4f63a4572cc7cca26d1d8a6b30e2fc79) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-core')
-rw-r--r--meta/recipes-core/glibc/glibc/0024-fix-create-thread-failed-in-unprivileged-process-BZ-.patch88
-rw-r--r--meta/recipes-core/glibc/glibc_2.35.bb1
2 files changed, 89 insertions, 0 deletions
diff --git a/meta/recipes-core/glibc/glibc/0024-fix-create-thread-failed-in-unprivileged-process-BZ-.patch b/meta/recipes-core/glibc/glibc/0024-fix-create-thread-failed-in-unprivileged-process-BZ-.patch
new file mode 100644
index 0000000000..b431ea168d
--- /dev/null
+++ b/meta/recipes-core/glibc/glibc/0024-fix-create-thread-failed-in-unprivileged-process-BZ-.patch
@@ -0,0 +1,88 @@
1From 6609858239b8f94e12c19eac0cec425511d1211f Mon Sep 17 00:00:00 2001
2From: Hongxu Jia <hongxu.jia@windriver.com>
3Date: Sun, 29 Aug 2021 20:49:16 +0800
4Subject: [PATCH] fix create thread failed in unprivileged process [BZ #28287]
5
6Since commit [d8ea0d0168 Add an internal wrapper for clone, clone2 and clone3]
7applied, start a unprivileged container (docker run without --privileged),
8it creates a thread failed in container.
9
10In commit d8ea0d0168, it calls __clone3 if HAVE_CLONE3_WAPPER is defined. If
11__clone3 returns -1 with ENOSYS, fall back to clone or clone2.
12
13As known from [1], cloneXXX fails with EPERM if CLONE_NEWCGROUP,
14CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, or CLONE_NEWUTS
15was specified by an unprivileged process (process without CAP_SYS_ADMIN)
16
17[1] https://man7.org/linux/man-pages/man2/clone3.2.html
18
19So if __clone3 returns -1 with EPERM, fall back to clone or clone2 could
20fix the issue. Here are the test steps:
21
221) Prepare test code
23cat > conftest.c <<ENDOF
24 #include <pthread.h>
25 #include <stdio.h>
26
27int check_me = 0;
28void* func(void* data) {check_me = 42; printf("start thread: check_me %d\n", check_me); return &check_me;}
29int main()
30{
31 pthread_t t;
32 void *ret;
33 pthread_create (&t, 0, func, 0);
34 pthread_join (t, &ret);
35 printf("check_me %d, p %p\n", check_me, &ret);
36 return (check_me != 42 || ret != &check_me);
37}
38
39ENDOF
40
412) Compile
42gcc -o conftest -pthread conftest.c
43
443) Start a container with glibc 2.34 installed
45[skip details]
46docker run -it <container-image-name> bash
47
484) Run conftest without this patch
49$ ./conftest
50check_me 0, p 0x7ffd91ccd400
51
525) Run conftest with this patch
53$ ./conftest
54start thread: check_me 42
55check_me 42, p 0x7ffe253c6f20
56
57Upstream-Status: Inappropriate [Rejected by upstream]
58
59Upstream glibc rejected it because the latest docker has resolved the issue [1],
60and upstream glibc does not backward compatibility with old docker[2]
61
62In order to build Yocto with uninative in old docker, we need this local
63patch
64
65[1] https://github.com/moby/moby/commit/9f6b562dd12ef7b1f9e2f8e6f2ab6477790a6594
66[2] https://sourceware.org/pipermail/libc-alpha/2021-August/130590.html
67
68Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
69---
70 sysdeps/unix/sysv/linux/clone-internal.c | 2 +-
71 1 file changed, 1 insertion(+), 1 deletion(-)
72
73diff --git a/sysdeps/unix/sysv/linux/clone-internal.c b/sysdeps/unix/sysv/linux/clone-internal.c
74index a71effcbd3..a0569113aa 100644
75--- a/sysdeps/unix/sysv/linux/clone-internal.c
76+++ b/sysdeps/unix/sysv/linux/clone-internal.c
77@@ -52,7 +52,7 @@ __clone_internal (struct clone_args *cl_args,
78 /* Try clone3 first. */
79 int saved_errno = errno;
80 ret = __clone3 (cl_args, sizeof (*cl_args), func, arg);
81- if (ret != -1 || errno != ENOSYS)
82+ if (ret != -1 || (errno != ENOSYS && errno != EPERM))
83 return ret;
84
85 /* NB: Restore errno since errno may be checked against non-zero
86--
872.27.0
88
diff --git a/meta/recipes-core/glibc/glibc_2.35.bb b/meta/recipes-core/glibc/glibc_2.35.bb
index 2903a4001f..b785b61154 100644
--- a/meta/recipes-core/glibc/glibc_2.35.bb
+++ b/meta/recipes-core/glibc/glibc_2.35.bb
@@ -47,6 +47,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
47 file://0021-Replace-echo-with-printf-builtin-in-nscd-init-script.patch \ 47 file://0021-Replace-echo-with-printf-builtin-in-nscd-init-script.patch \
48 file://0022-sysdeps-gnu-configure.ac-Set-libc_cv_rootsbindir-onl.patch \ 48 file://0022-sysdeps-gnu-configure.ac-Set-libc_cv_rootsbindir-onl.patch \
49 file://0023-timezone-Make-shell-interpreter-overridable-in-tzsel.patch \ 49 file://0023-timezone-Make-shell-interpreter-overridable-in-tzsel.patch \
50 file://0024-fix-create-thread-failed-in-unprivileged-process-BZ-.patch \
50 " 51 "
51S = "${WORKDIR}/git" 52S = "${WORKDIR}/git"
52B = "${WORKDIR}/build-${TARGET_SYS}" 53B = "${WORKDIR}/build-${TARGET_SYS}"