Re: [PATCH ima-evm-utils 2/2] upgrade to glibc-2.34 uses clone3 causing CI to fail

["Dmitry V. Levin" <ldv@altlinux.org>]

Hi,

On Tue, Oct 26, 2021 at 05:30:54PM +0300, Vitaly Chikunov wrote:
> Mimi,
> 
> On Mon, Oct 25, 2021 at 10:49:29PM -0400, Mimi Zohar wrote:
> > Both opensuse/tumbleweed and Alt Linux have upgraded to glibc-2.34,
> > causing the CI testing to fail.  Disable seccomp (which is not needed
> > anyway, since GA uses throwable virtual environments anyway).
> 
> JFYI. We decided to update our glibc package to fall-back from clone3 to
> clone in case it's EPERM. So, after some time (perhaps a day) this
> workaround will not be needed for ALT Linux. But this will not hurts
> either and may be beneficial in the future.

Citing myself [3]:

"you must have missed the whole discussion on this subject [1][2],
the consensus was that problematic container runtimes need to be fixed
to make their seccomp filters return ENOSYS for unknown syscalls.

[1] https://sourceware.org/pipermail/libc-alpha/2020-November/119955.html
[2] https://lore.kernel.org/linux-api/87lfer2c0b.fsf@oldenburg2.str.redhat.com/T/#u
"
 
That discussion was about a different syscall, but the problem is
essentially the same, and all who commented on the subject more or less
vehemently rejected the idea of adding this kind of hacks into glibc.
Therefore, I think that change in ALT glibc has to be reconsidered,
and problematic container runtimes have to be fixed instead.
  
[3] https://sourceware.org/pipermail/libc-alpha/2021-February/123008.html


-- 
ldv