All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] glibc: fix create thread failed in unprivileged process
@ 2021-08-29 13:52 hongxu
  2021-08-29 16:18 ` [OE-core] " Khem Raj
  0 siblings, 1 reply; 5+ messages in thread
From: hongxu @ 2021-08-29 13:52 UTC (permalink / raw)
  To: openembedded-core, richard.purdie

Since upstream commit [d8ea0d0168 Add an internal wrapper for clone, clone2
and clone3] applied, start a unprivileged container (docker run without
--privileged), it creates a thread failed in container.

In commit d8ea0d0168, it calls __clone3 if HAVE_CLONE3_WAPPER is defined.  If
__clone3 returns -1 with ENOSYS, fall back to clone or clone2.

As known from [1], cloneXXX fails with EPERM if CLONE_NEWCGROUP,
CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, or CLONE_NEWUTS
was specified by an unprivileged process (process without CAP_SYS_ADMIN)

[1] https://man7.org/linux/man-pages/man2/clone3.2.html

So if __clone3 returns -1 with EPERM, fall back to clone or clone2 could
fix the issue.

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
---
 ...d-failed-in-unprivileged-process-BZ-.patch | 79 +++++++++++++++++++
 meta/recipes-core/glibc/glibc_2.34.bb         |  1 +
 2 files changed, 80 insertions(+)
 create mode 100644 meta/recipes-core/glibc/glibc/0001-fix-create-thread-failed-in-unprivileged-process-BZ-.patch

diff --git a/meta/recipes-core/glibc/glibc/0001-fix-create-thread-failed-in-unprivileged-process-BZ-.patch b/meta/recipes-core/glibc/glibc/0001-fix-create-thread-failed-in-unprivileged-process-BZ-.patch
new file mode 100644
index 0000000000..3283dd7ad8
--- /dev/null
+++ b/meta/recipes-core/glibc/glibc/0001-fix-create-thread-failed-in-unprivileged-process-BZ-.patch
@@ -0,0 +1,79 @@
+From a8bc44936202692edcd82a48c07d7cf27d6ed8ee Mon Sep 17 00:00:00 2001
+From: Hongxu Jia <hongxu.jia@windriver.com>
+Date: Sun, 29 Aug 2021 20:49:16 +0800
+Subject: [PATCH] fix create thread failed in unprivileged process [BZ #28287]
+
+Since commit [d8ea0d0168 Add an internal wrapper for clone, clone2 and clone3]
+applied, start a unprivileged container (docker run without --privileged),
+it creates a thread failed in container.
+
+In commit d8ea0d0168, it calls __clone3 if HAVE_CLONE3_WAPPER is defined.  If
+__clone3 returns -1 with ENOSYS, fall back to clone or clone2.
+
+As known from [1], cloneXXX fails with EPERM if CLONE_NEWCGROUP,
+CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, or CLONE_NEWUTS
+was specified by an unprivileged process (process without CAP_SYS_ADMIN)
+
+[1] https://man7.org/linux/man-pages/man2/clone3.2.html
+
+So if __clone3 returns -1 with EPERM, fall back to clone or clone2 could
+fix the issue. Here are the test steps:
+
+1) Prepare test code
+cat > conftest.c <<ENDOF
+ #include <pthread.h>
+ #include <stdio.h>
+
+int check_me = 0;
+void* func(void* data) {check_me = 42; printf("start thread: check_me %d\n", check_me); return &check_me;}
+int main()
+{
+  pthread_t t;
+  void *ret;
+  pthread_create (&t, 0, func, 0);
+  pthread_join (t, &ret);
+  printf("check_me %d, p %p\n", check_me, &ret);
+  return (check_me != 42 || ret != &check_me);
+}
+
+ENDOF
+
+2) Compile
+gcc -o conftest -pthread conftest.c
+
+3) Start a container with glibc 2.34 installed
+[skip details]
+docker run -it <container-image-name> bash
+
+4) Run conftest without this patch
+$ ./conftest
+check_me 0, p 0x7ffd91ccd400
+
+5) Run conftest with this patch
+$ ./conftest
+start thread: check_me 42
+check_me 42, p 0x7ffe253c6f20
+
+Upstream-Status: Submitted [libc-alpha@sourceware.org]
+
+Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+---
+ sysdeps/unix/sysv/linux/clone-internal.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sysdeps/unix/sysv/linux/clone-internal.c b/sysdeps/unix/sysv/linux/clone-internal.c
+index 979f7880be..97101994e8 100644
+--- a/sysdeps/unix/sysv/linux/clone-internal.c
++++ b/sysdeps/unix/sysv/linux/clone-internal.c
+@@ -52,7 +52,7 @@ __clone_internal (struct clone_args *cl_args,
+   /* Try clone3 first.  */
+   int saved_errno = errno;
+   ret = __clone3 (cl_args, sizeof (*cl_args), func, arg);
+-  if (ret != -1 || errno != ENOSYS)
++  if (ret != -1 || (errno != ENOSYS && errno != EPERM))
+     return ret;
+ 
+   /* NB: Restore errno since errno may be checked against non-zero
+-- 
+2.30.2
+
diff --git a/meta/recipes-core/glibc/glibc_2.34.bb b/meta/recipes-core/glibc/glibc_2.34.bb
index eafc0216ff..6dc315c349 100644
--- a/meta/recipes-core/glibc/glibc_2.34.bb
+++ b/meta/recipes-core/glibc/glibc_2.34.bb
@@ -57,6 +57,7 @@ SRC_URI =  "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
            file://0030-powerpc-Do-not-ask-compiler-for-finding-arch.patch \
            file://0001-CVE-2021-38604.patch \
            file://0002-CVE-2021-38604.patch \
+           file://0001-fix-create-thread-failed-in-unprivileged-process-BZ-.patch \
            "
 S = "${WORKDIR}/git"
 B = "${WORKDIR}/build-${TARGET_SYS}"
-- 
2.27.0


^ permalink raw reply related	[flat|nested] 5+ messages in thread

* Re: [OE-core] [PATCH] glibc: fix create thread failed in unprivileged process
  2021-08-29 13:52 [PATCH] glibc: fix create thread failed in unprivileged process hongxu
@ 2021-08-29 16:18 ` Khem Raj
  2021-08-30  1:55   ` hongxu
  0 siblings, 1 reply; 5+ messages in thread
From: Khem Raj @ 2021-08-29 16:18 UTC (permalink / raw)
  To: hongxu, openembedded-core, richard.purdie



On 8/29/21 6:52 AM, hongxu wrote:
> Since upstream commit [d8ea0d0168 Add an internal wrapper for clone, clone2
> and clone3] applied, start a unprivileged container (docker run without
> --privileged), it creates a thread failed in container.
> 
> In commit d8ea0d0168, it calls __clone3 if HAVE_CLONE3_WAPPER is defined.  If
> __clone3 returns -1 with ENOSYS, fall back to clone or clone2.
> 
> As known from [1], cloneXXX fails with EPERM if CLONE_NEWCGROUP,
> CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, or CLONE_NEWUTS
> was specified by an unprivileged process (process without CAP_SYS_ADMIN)
> 
> [1] https://man7.org/linux/man-pages/man2/clone3.2.html
> 
> So if __clone3 returns -1 with EPERM, fall back to clone or clone2 could
> fix the issue.
> 

I think this is application issue so perhaps should be fixed in 
container runtime and not in glibc so fixing glibc here sounds to be 
wrong approach. You probably should disable clone3 wrapper completely or 
via tunables when launching the container runtime maybe.


> Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
> ---
>   ...d-failed-in-unprivileged-process-BZ-.patch | 79 +++++++++++++++++++
>   meta/recipes-core/glibc/glibc_2.34.bb         |  1 +
>   2 files changed, 80 insertions(+)
>   create mode 100644 meta/recipes-core/glibc/glibc/0001-fix-create-thread-failed-in-unprivileged-process-BZ-.patch
> 
> diff --git a/meta/recipes-core/glibc/glibc/0001-fix-create-thread-failed-in-unprivileged-process-BZ-.patch b/meta/recipes-core/glibc/glibc/0001-fix-create-thread-failed-in-unprivileged-process-BZ-.patch
> new file mode 100644
> index 0000000000..3283dd7ad8
> --- /dev/null
> +++ b/meta/recipes-core/glibc/glibc/0001-fix-create-thread-failed-in-unprivileged-process-BZ-.patch
> @@ -0,0 +1,79 @@
> +From a8bc44936202692edcd82a48c07d7cf27d6ed8ee Mon Sep 17 00:00:00 2001
> +From: Hongxu Jia <hongxu.jia@windriver.com>
> +Date: Sun, 29 Aug 2021 20:49:16 +0800
> +Subject: [PATCH] fix create thread failed in unprivileged process [BZ #28287]
> +
> +Since commit [d8ea0d0168 Add an internal wrapper for clone, clone2 and clone3]
> +applied, start a unprivileged container (docker run without --privileged),
> +it creates a thread failed in container.
> +
> +In commit d8ea0d0168, it calls __clone3 if HAVE_CLONE3_WAPPER is defined.  If
> +__clone3 returns -1 with ENOSYS, fall back to clone or clone2.
> +
> +As known from [1], cloneXXX fails with EPERM if CLONE_NEWCGROUP,
> +CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, or CLONE_NEWUTS
> +was specified by an unprivileged process (process without CAP_SYS_ADMIN)
> +
> +[1] https://man7.org/linux/man-pages/man2/clone3.2.html
> +
> +So if __clone3 returns -1 with EPERM, fall back to clone or clone2 could
> +fix the issue. Here are the test steps:
> +
> +1) Prepare test code
> +cat > conftest.c <<ENDOF
> + #include <pthread.h>
> + #include <stdio.h>
> +
> +int check_me = 0;
> +void* func(void* data) {check_me = 42; printf("start thread: check_me %d\n", check_me); return &check_me;}
> +int main()
> +{
> +  pthread_t t;
> +  void *ret;
> +  pthread_create (&t, 0, func, 0);
> +  pthread_join (t, &ret);
> +  printf("check_me %d, p %p\n", check_me, &ret);
> +  return (check_me != 42 || ret != &check_me);
> +}
> +
> +ENDOF
> +
> +2) Compile
> +gcc -o conftest -pthread conftest.c
> +
> +3) Start a container with glibc 2.34 installed
> +[skip details]
> +docker run -it <container-image-name> bash
> +
> +4) Run conftest without this patch
> +$ ./conftest
> +check_me 0, p 0x7ffd91ccd400
> +
> +5) Run conftest with this patch
> +$ ./conftest
> +start thread: check_me 42
> +check_me 42, p 0x7ffe253c6f20
> +
> +Upstream-Status: Submitted [libc-alpha@sourceware.org]
> +
> +Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
> +---
> + sysdeps/unix/sysv/linux/clone-internal.c | 2 +-
> + 1 file changed, 1 insertion(+), 1 deletion(-)
> +
> +diff --git a/sysdeps/unix/sysv/linux/clone-internal.c b/sysdeps/unix/sysv/linux/clone-internal.c
> +index 979f7880be..97101994e8 100644
> +--- a/sysdeps/unix/sysv/linux/clone-internal.c
> ++++ b/sysdeps/unix/sysv/linux/clone-internal.c
> +@@ -52,7 +52,7 @@ __clone_internal (struct clone_args *cl_args,
> +   /* Try clone3 first.  */
> +   int saved_errno = errno;
> +   ret = __clone3 (cl_args, sizeof (*cl_args), func, arg);
> +-  if (ret != -1 || errno != ENOSYS)
> ++  if (ret != -1 || (errno != ENOSYS && errno != EPERM))
> +     return ret;
> +
> +   /* NB: Restore errno since errno may be checked against non-zero
> +--
> +2.30.2
> +
> diff --git a/meta/recipes-core/glibc/glibc_2.34.bb b/meta/recipes-core/glibc/glibc_2.34.bb
> index eafc0216ff..6dc315c349 100644
> --- a/meta/recipes-core/glibc/glibc_2.34.bb
> +++ b/meta/recipes-core/glibc/glibc_2.34.bb
> @@ -57,6 +57,7 @@ SRC_URI =  "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
>              file://0030-powerpc-Do-not-ask-compiler-for-finding-arch.patch \
>              file://0001-CVE-2021-38604.patch \
>              file://0002-CVE-2021-38604.patch \
> +           file://0001-fix-create-thread-failed-in-unprivileged-process-BZ-.patch \
>              "
>   S = "${WORKDIR}/git"
>   B = "${WORKDIR}/build-${TARGET_SYS}"
> 
> 
> 
> 
> 

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [OE-core] [PATCH] glibc: fix create thread failed in unprivileged process
  2021-08-29 16:18 ` [OE-core] " Khem Raj
@ 2021-08-30  1:55   ` hongxu
  0 siblings, 0 replies; 5+ messages in thread
From: hongxu @ 2021-08-30  1:55 UTC (permalink / raw)
  To: Khem Raj, openembedded-core, richard.purdie

On 8/30/21 12:18 AM, Khem Raj wrote:
> [Please note: This e-mail is from an EXTERNAL e-mail address]
>
> On 8/29/21 6:52 AM, hongxu wrote:
>> Since upstream commit [d8ea0d0168 Add an internal wrapper for clone, 
>> clone2
>> and clone3] applied, start a unprivileged container (docker run without
>> --privileged), it creates a thread failed in container.
>>
>> In commit d8ea0d0168, it calls __clone3 if HAVE_CLONE3_WAPPER is 
>> defined.  If
>> __clone3 returns -1 with ENOSYS, fall back to clone or clone2.
>>
>> As known from [1], cloneXXX fails with EPERM if CLONE_NEWCGROUP,
>> CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, or CLONE_NEWUTS
>> was specified by an unprivileged process (process without CAP_SYS_ADMIN)
>>
>> [1] https://man7.org/linux/man-pages/man2/clone3.2.html
>>
>> So if __clone3 returns -1 with EPERM, fall back to clone or clone2 could
>> fix the issue.
>>
>
> I think this is application issue so perhaps should be fixed in
> container runtime and not in glibc so fixing glibc here sounds to be
> wrong approach. You probably should disable clone3 wrapper completely or
> via tunables when launching the container runtime maybe.
>
 From container side, the docker has fixed the issue in commit 
https://github.com/moby/moby/commit/9f6b562dd12ef7b1f9e2f8e6f2ab6477790a6594

For glibc side, discussed with upstream maintainer 
https://sourceware.org/pipermail/libc-alpha/2021-August/130591.html

it is better to disable clone3 wrapper in out Yocto glibc to backward 
compatibility with old docker

V2 incoming

//Hongxu

>
>> Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
>> ---
>>   ...d-failed-in-unprivileged-process-BZ-.patch | 79 +++++++++++++++++++
>>   meta/recipes-core/glibc/glibc_2.34.bb         |  1 +
>>   2 files changed, 80 insertions(+)
>>   create mode 100644 
>> meta/recipes-core/glibc/glibc/0001-fix-create-thread-failed-in-unprivileged-process-BZ-.patch
>>
>> diff --git 
>> a/meta/recipes-core/glibc/glibc/0001-fix-create-thread-failed-in-unprivileged-process-BZ-.patch 
>> b/meta/recipes-core/glibc/glibc/0001-fix-create-thread-failed-in-unprivileged-process-BZ-.patch 
>>
>> new file mode 100644
>> index 0000000000..3283dd7ad8
>> --- /dev/null
>> +++ 
>> b/meta/recipes-core/glibc/glibc/0001-fix-create-thread-failed-in-unprivileged-process-BZ-.patch
>> @@ -0,0 +1,79 @@
>> +From a8bc44936202692edcd82a48c07d7cf27d6ed8ee Mon Sep 17 00:00:00 2001
>> +From: Hongxu Jia <hongxu.jia@windriver.com>
>> +Date: Sun, 29 Aug 2021 20:49:16 +0800
>> +Subject: [PATCH] fix create thread failed in unprivileged process 
>> [BZ #28287]
>> +
>> +Since commit [d8ea0d0168 Add an internal wrapper for clone, clone2 
>> and clone3]
>> +applied, start a unprivileged container (docker run without 
>> --privileged),
>> +it creates a thread failed in container.
>> +
>> +In commit d8ea0d0168, it calls __clone3 if HAVE_CLONE3_WAPPER is 
>> defined.  If
>> +__clone3 returns -1 with ENOSYS, fall back to clone or clone2.
>> +
>> +As known from [1], cloneXXX fails with EPERM if CLONE_NEWCGROUP,
>> +CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, or CLONE_NEWUTS
>> +was specified by an unprivileged process (process without 
>> CAP_SYS_ADMIN)
>> +
>> +[1] https://man7.org/linux/man-pages/man2/clone3.2.html
>> +
>> +So if __clone3 returns -1 with EPERM, fall back to clone or clone2 
>> could
>> +fix the issue. Here are the test steps:
>> +
>> +1) Prepare test code
>> +cat > conftest.c <<ENDOF
>> + #include <pthread.h>
>> + #include <stdio.h>
>> +
>> +int check_me = 0;
>> +void* func(void* data) {check_me = 42; printf("start thread: 
>> check_me %d\n", check_me); return &check_me;}
>> +int main()
>> +{
>> +  pthread_t t;
>> +  void *ret;
>> +  pthread_create (&t, 0, func, 0);
>> +  pthread_join (t, &ret);
>> +  printf("check_me %d, p %p\n", check_me, &ret);
>> +  return (check_me != 42 || ret != &check_me);
>> +}
>> +
>> +ENDOF
>> +
>> +2) Compile
>> +gcc -o conftest -pthread conftest.c
>> +
>> +3) Start a container with glibc 2.34 installed
>> +[skip details]
>> +docker run -it <container-image-name> bash
>> +
>> +4) Run conftest without this patch
>> +$ ./conftest
>> +check_me 0, p 0x7ffd91ccd400
>> +
>> +5) Run conftest with this patch
>> +$ ./conftest
>> +start thread: check_me 42
>> +check_me 42, p 0x7ffe253c6f20
>> +
>> +Upstream-Status: Submitted [libc-alpha@sourceware.org]
>> +
>> +Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
>> +---
>> + sysdeps/unix/sysv/linux/clone-internal.c | 2 +-
>> + 1 file changed, 1 insertion(+), 1 deletion(-)
>> +
>> +diff --git a/sysdeps/unix/sysv/linux/clone-internal.c 
>> b/sysdeps/unix/sysv/linux/clone-internal.c
>> +index 979f7880be..97101994e8 100644
>> +--- a/sysdeps/unix/sysv/linux/clone-internal.c
>> ++++ b/sysdeps/unix/sysv/linux/clone-internal.c
>> +@@ -52,7 +52,7 @@ __clone_internal (struct clone_args *cl_args,
>> +   /* Try clone3 first.  */
>> +   int saved_errno = errno;
>> +   ret = __clone3 (cl_args, sizeof (*cl_args), func, arg);
>> +-  if (ret != -1 || errno != ENOSYS)
>> ++  if (ret != -1 || (errno != ENOSYS && errno != EPERM))
>> +     return ret;
>> +
>> +   /* NB: Restore errno since errno may be checked against non-zero
>> +--
>> +2.30.2
>> +
>> diff --git a/meta/recipes-core/glibc/glibc_2.34.bb 
>> b/meta/recipes-core/glibc/glibc_2.34.bb
>> index eafc0216ff..6dc315c349 100644
>> --- a/meta/recipes-core/glibc/glibc_2.34.bb
>> +++ b/meta/recipes-core/glibc/glibc_2.34.bb
>> @@ -57,6 +57,7 @@ SRC_URI = 
>> "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
>> file://0030-powerpc-Do-not-ask-compiler-for-finding-arch.patch \
>>              file://0001-CVE-2021-38604.patch \
>>              file://0002-CVE-2021-38604.patch \
>> + 
>> file://0001-fix-create-thread-failed-in-unprivileged-process-BZ-.patch \
>>              "
>>   S = "${WORKDIR}/git"
>>   B = "${WORKDIR}/build-${TARGET_SYS}"
>>
>>
>>
>> 
>>


^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [OE-core] [PATCH] glibc: fix create thread failed in unprivileged process
  2022-02-16  7:54 ` [OE-core] " Alexander Kanavin
@ 2022-02-21 12:19   ` Ross Burton
  0 siblings, 0 replies; 5+ messages in thread
From: Ross Burton @ 2022-02-21 12:19 UTC (permalink / raw)
  To: Alexander Kanavin; +Cc: hongxu, OE-core, Richard Purdie, Khem Raj

Agreed.  Our CI used to hit this problem but we were missing some
upgrades on one of the runners, and now we don't need it.

Ross

On Wed, 16 Feb 2022 at 07:54, Alexander Kanavin <alex.kanavin@gmail.com> wrote:
>
> This is presumably to support builds on some old distribution, so it
> would help if you specify which distribution and which versions of
> docker require this. Otherwise we'll never know when we can drop the
> patch.
>
> Alex
>
> On Wed, 16 Feb 2022 at 03:54, hongxu <hongxu.jia@windriver.com> wrote:
> >
> > Since upstream commit [d8ea0d0168 Add an internal wrapper for clone, clone2
> > and clone3] applied, start a unprivileged container (docker run without
> > --privileged), it creates a thread failed in container.
> >
> > In commit d8ea0d0168, it calls __clone3 if HAVE_CLONE3_WAPPER is defined.  If
> > __clone3 returns -1 with ENOSYS, fall back to clone or clone2.
> >
> > As known from [1], cloneXXX fails with EPERM if CLONE_NEWCGROUP,
> > CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, or CLONE_NEWUTS
> > was specified by an unprivileged process (process without CAP_SYS_ADMIN)
> >
> > [1] https://man7.org/linux/man-pages/man2/clone3.2.html
> >
> > So if __clone3 returns -1 with EPERM, fall back to clone or clone2 could
> > fix the issue.
> >
> > Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
> > ---
> >  ...d-failed-in-unprivileged-process-BZ-.patch | 88 +++++++++++++++++++
> >  meta/recipes-core/glibc/glibc_2.35.bb         |  1 +
> >  2 files changed, 89 insertions(+)
> >  create mode 100644 meta/recipes-core/glibc/glibc/0024-fix-create-thread-failed-in-unprivileged-process-BZ-.patch
> >
> > diff --git a/meta/recipes-core/glibc/glibc/0024-fix-create-thread-failed-in-unprivileged-process-BZ-.patch b/meta/recipes-core/glibc/glibc/0024-fix-create-thread-failed-in-unprivileged-process-BZ-.patch
> > new file mode 100644
> > index 0000000000..b431ea168d
> > --- /dev/null
> > +++ b/meta/recipes-core/glibc/glibc/0024-fix-create-thread-failed-in-unprivileged-process-BZ-.patch
> > @@ -0,0 +1,88 @@
> > +From 6609858239b8f94e12c19eac0cec425511d1211f Mon Sep 17 00:00:00 2001
> > +From: Hongxu Jia <hongxu.jia@windriver.com>
> > +Date: Sun, 29 Aug 2021 20:49:16 +0800
> > +Subject: [PATCH] fix create thread failed in unprivileged process [BZ #28287]
> > +
> > +Since commit [d8ea0d0168 Add an internal wrapper for clone, clone2 and clone3]
> > +applied, start a unprivileged container (docker run without --privileged),
> > +it creates a thread failed in container.
> > +
> > +In commit d8ea0d0168, it calls __clone3 if HAVE_CLONE3_WAPPER is defined.  If
> > +__clone3 returns -1 with ENOSYS, fall back to clone or clone2.
> > +
> > +As known from [1], cloneXXX fails with EPERM if CLONE_NEWCGROUP,
> > +CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, or CLONE_NEWUTS
> > +was specified by an unprivileged process (process without CAP_SYS_ADMIN)
> > +
> > +[1] https://man7.org/linux/man-pages/man2/clone3.2.html
> > +
> > +So if __clone3 returns -1 with EPERM, fall back to clone or clone2 could
> > +fix the issue. Here are the test steps:
> > +
> > +1) Prepare test code
> > +cat > conftest.c <<ENDOF
> > + #include <pthread.h>
> > + #include <stdio.h>
> > +
> > +int check_me = 0;
> > +void* func(void* data) {check_me = 42; printf("start thread: check_me %d\n", check_me); return &check_me;}
> > +int main()
> > +{
> > +  pthread_t t;
> > +  void *ret;
> > +  pthread_create (&t, 0, func, 0);
> > +  pthread_join (t, &ret);
> > +  printf("check_me %d, p %p\n", check_me, &ret);
> > +  return (check_me != 42 || ret != &check_me);
> > +}
> > +
> > +ENDOF
> > +
> > +2) Compile
> > +gcc -o conftest -pthread conftest.c
> > +
> > +3) Start a container with glibc 2.34 installed
> > +[skip details]
> > +docker run -it <container-image-name> bash
> > +
> > +4) Run conftest without this patch
> > +$ ./conftest
> > +check_me 0, p 0x7ffd91ccd400
> > +
> > +5) Run conftest with this patch
> > +$ ./conftest
> > +start thread: check_me 42
> > +check_me 42, p 0x7ffe253c6f20
> > +
> > +Upstream-Status: Inappropriate [Rejected by upstream]
> > +
> > +Upstream glibc rejected it because the latest docker has resolved the issue [1],
> > +and upstream glibc does not backward compatibility with old docker[2]
> > +
> > +In order to build Yocto with uninative in old docker, we need this local
> > +patch
> > +
> > +[1] https://github.com/moby/moby/commit/9f6b562dd12ef7b1f9e2f8e6f2ab6477790a6594
> > +[2] https://sourceware.org/pipermail/libc-alpha/2021-August/130590.html
> > +
> > +Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
> > +---
> > + sysdeps/unix/sysv/linux/clone-internal.c | 2 +-
> > + 1 file changed, 1 insertion(+), 1 deletion(-)
> > +
> > +diff --git a/sysdeps/unix/sysv/linux/clone-internal.c b/sysdeps/unix/sysv/linux/clone-internal.c
> > +index a71effcbd3..a0569113aa 100644
> > +--- a/sysdeps/unix/sysv/linux/clone-internal.c
> > ++++ b/sysdeps/unix/sysv/linux/clone-internal.c
> > +@@ -52,7 +52,7 @@ __clone_internal (struct clone_args *cl_args,
> > +   /* Try clone3 first.  */
> > +   int saved_errno = errno;
> > +   ret = __clone3 (cl_args, sizeof (*cl_args), func, arg);
> > +-  if (ret != -1 || errno != ENOSYS)
> > ++  if (ret != -1 || (errno != ENOSYS && errno != EPERM))
> > +     return ret;
> > +
> > +   /* NB: Restore errno since errno may be checked against non-zero
> > +--
> > +2.27.0
> > +
> > diff --git a/meta/recipes-core/glibc/glibc_2.35.bb b/meta/recipes-core/glibc/glibc_2.35.bb
> > index 2903a4001f..b785b61154 100644
> > --- a/meta/recipes-core/glibc/glibc_2.35.bb
> > +++ b/meta/recipes-core/glibc/glibc_2.35.bb
> > @@ -47,6 +47,7 @@ SRC_URI =  "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
> >             file://0021-Replace-echo-with-printf-builtin-in-nscd-init-script.patch \
> >             file://0022-sysdeps-gnu-configure.ac-Set-libc_cv_rootsbindir-onl.patch \
> >             file://0023-timezone-Make-shell-interpreter-overridable-in-tzsel.patch \
> > +           file://0024-fix-create-thread-failed-in-unprivileged-process-BZ-.patch \
> >             "
> >  S = "${WORKDIR}/git"
> >  B = "${WORKDIR}/build-${TARGET_SYS}"
> > --
> > 2.27.0
> >
> >
> >
> >
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#161770): https://lists.openembedded.org/g/openembedded-core/message/161770
> Mute This Topic: https://lists.openembedded.org/mt/89178137/1676615
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [ross@burtonini.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>


^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [OE-core] [PATCH] glibc: fix create thread failed in unprivileged process
  2022-02-16  2:54 Hongxu Jia
@ 2022-02-16  7:54 ` Alexander Kanavin
  2022-02-21 12:19   ` Ross Burton
  0 siblings, 1 reply; 5+ messages in thread
From: Alexander Kanavin @ 2022-02-16  7:54 UTC (permalink / raw)
  To: hongxu; +Cc: OE-core, Richard Purdie, Khem Raj

This is presumably to support builds on some old distribution, so it
would help if you specify which distribution and which versions of
docker require this. Otherwise we'll never know when we can drop the
patch.

Alex

On Wed, 16 Feb 2022 at 03:54, hongxu <hongxu.jia@windriver.com> wrote:
>
> Since upstream commit [d8ea0d0168 Add an internal wrapper for clone, clone2
> and clone3] applied, start a unprivileged container (docker run without
> --privileged), it creates a thread failed in container.
>
> In commit d8ea0d0168, it calls __clone3 if HAVE_CLONE3_WAPPER is defined.  If
> __clone3 returns -1 with ENOSYS, fall back to clone or clone2.
>
> As known from [1], cloneXXX fails with EPERM if CLONE_NEWCGROUP,
> CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, or CLONE_NEWUTS
> was specified by an unprivileged process (process without CAP_SYS_ADMIN)
>
> [1] https://man7.org/linux/man-pages/man2/clone3.2.html
>
> So if __clone3 returns -1 with EPERM, fall back to clone or clone2 could
> fix the issue.
>
> Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
> ---
>  ...d-failed-in-unprivileged-process-BZ-.patch | 88 +++++++++++++++++++
>  meta/recipes-core/glibc/glibc_2.35.bb         |  1 +
>  2 files changed, 89 insertions(+)
>  create mode 100644 meta/recipes-core/glibc/glibc/0024-fix-create-thread-failed-in-unprivileged-process-BZ-.patch
>
> diff --git a/meta/recipes-core/glibc/glibc/0024-fix-create-thread-failed-in-unprivileged-process-BZ-.patch b/meta/recipes-core/glibc/glibc/0024-fix-create-thread-failed-in-unprivileged-process-BZ-.patch
> new file mode 100644
> index 0000000000..b431ea168d
> --- /dev/null
> +++ b/meta/recipes-core/glibc/glibc/0024-fix-create-thread-failed-in-unprivileged-process-BZ-.patch
> @@ -0,0 +1,88 @@
> +From 6609858239b8f94e12c19eac0cec425511d1211f Mon Sep 17 00:00:00 2001
> +From: Hongxu Jia <hongxu.jia@windriver.com>
> +Date: Sun, 29 Aug 2021 20:49:16 +0800
> +Subject: [PATCH] fix create thread failed in unprivileged process [BZ #28287]
> +
> +Since commit [d8ea0d0168 Add an internal wrapper for clone, clone2 and clone3]
> +applied, start a unprivileged container (docker run without --privileged),
> +it creates a thread failed in container.
> +
> +In commit d8ea0d0168, it calls __clone3 if HAVE_CLONE3_WAPPER is defined.  If
> +__clone3 returns -1 with ENOSYS, fall back to clone or clone2.
> +
> +As known from [1], cloneXXX fails with EPERM if CLONE_NEWCGROUP,
> +CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, or CLONE_NEWUTS
> +was specified by an unprivileged process (process without CAP_SYS_ADMIN)
> +
> +[1] https://man7.org/linux/man-pages/man2/clone3.2.html
> +
> +So if __clone3 returns -1 with EPERM, fall back to clone or clone2 could
> +fix the issue. Here are the test steps:
> +
> +1) Prepare test code
> +cat > conftest.c <<ENDOF
> + #include <pthread.h>
> + #include <stdio.h>
> +
> +int check_me = 0;
> +void* func(void* data) {check_me = 42; printf("start thread: check_me %d\n", check_me); return &check_me;}
> +int main()
> +{
> +  pthread_t t;
> +  void *ret;
> +  pthread_create (&t, 0, func, 0);
> +  pthread_join (t, &ret);
> +  printf("check_me %d, p %p\n", check_me, &ret);
> +  return (check_me != 42 || ret != &check_me);
> +}
> +
> +ENDOF
> +
> +2) Compile
> +gcc -o conftest -pthread conftest.c
> +
> +3) Start a container with glibc 2.34 installed
> +[skip details]
> +docker run -it <container-image-name> bash
> +
> +4) Run conftest without this patch
> +$ ./conftest
> +check_me 0, p 0x7ffd91ccd400
> +
> +5) Run conftest with this patch
> +$ ./conftest
> +start thread: check_me 42
> +check_me 42, p 0x7ffe253c6f20
> +
> +Upstream-Status: Inappropriate [Rejected by upstream]
> +
> +Upstream glibc rejected it because the latest docker has resolved the issue [1],
> +and upstream glibc does not backward compatibility with old docker[2]
> +
> +In order to build Yocto with uninative in old docker, we need this local
> +patch
> +
> +[1] https://github.com/moby/moby/commit/9f6b562dd12ef7b1f9e2f8e6f2ab6477790a6594
> +[2] https://sourceware.org/pipermail/libc-alpha/2021-August/130590.html
> +
> +Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
> +---
> + sysdeps/unix/sysv/linux/clone-internal.c | 2 +-
> + 1 file changed, 1 insertion(+), 1 deletion(-)
> +
> +diff --git a/sysdeps/unix/sysv/linux/clone-internal.c b/sysdeps/unix/sysv/linux/clone-internal.c
> +index a71effcbd3..a0569113aa 100644
> +--- a/sysdeps/unix/sysv/linux/clone-internal.c
> ++++ b/sysdeps/unix/sysv/linux/clone-internal.c
> +@@ -52,7 +52,7 @@ __clone_internal (struct clone_args *cl_args,
> +   /* Try clone3 first.  */
> +   int saved_errno = errno;
> +   ret = __clone3 (cl_args, sizeof (*cl_args), func, arg);
> +-  if (ret != -1 || errno != ENOSYS)
> ++  if (ret != -1 || (errno != ENOSYS && errno != EPERM))
> +     return ret;
> +
> +   /* NB: Restore errno since errno may be checked against non-zero
> +--
> +2.27.0
> +
> diff --git a/meta/recipes-core/glibc/glibc_2.35.bb b/meta/recipes-core/glibc/glibc_2.35.bb
> index 2903a4001f..b785b61154 100644
> --- a/meta/recipes-core/glibc/glibc_2.35.bb
> +++ b/meta/recipes-core/glibc/glibc_2.35.bb
> @@ -47,6 +47,7 @@ SRC_URI =  "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
>             file://0021-Replace-echo-with-printf-builtin-in-nscd-init-script.patch \
>             file://0022-sysdeps-gnu-configure.ac-Set-libc_cv_rootsbindir-onl.patch \
>             file://0023-timezone-Make-shell-interpreter-overridable-in-tzsel.patch \
> +           file://0024-fix-create-thread-failed-in-unprivileged-process-BZ-.patch \
>             "
>  S = "${WORKDIR}/git"
>  B = "${WORKDIR}/build-${TARGET_SYS}"
> --
> 2.27.0
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#161764): https://lists.openembedded.org/g/openembedded-core/message/161764
> Mute This Topic: https://lists.openembedded.org/mt/89178137/1686489
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [alex.kanavin@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>


^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2022-02-21 12:19 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-08-29 13:52 [PATCH] glibc: fix create thread failed in unprivileged process hongxu
2021-08-29 16:18 ` [OE-core] " Khem Raj
2021-08-30  1:55   ` hongxu
2022-02-16  2:54 Hongxu Jia
2022-02-16  7:54 ` [OE-core] " Alexander Kanavin
2022-02-21 12:19   ` Ross Burton

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.