All of lore.kernel.org
 help / color / mirror / Atom feed
* [LTP] [PATCH 1/1] CI: Reenable Tumbleweed
@ 2021-10-27  9:20 Petr Vorel
  2021-10-27  9:42 ` Petr Vorel
  0 siblings, 1 reply; 6+ messages in thread
From: Petr Vorel @ 2021-10-27  9:20 UTC (permalink / raw)
  To: ltp

50b3bae29 had to disable Tumbleweed due glibc-2.34 using new syscall
clone3 which is not enabled in Docker seccomp filter [1].

Workaround is to disable Docker seccomp filtering, as we don't need this
protection. This should help to avoid seccomp filtering in the future
for all distros.

[1] https://bugzilla.opensuse.org/show_bug.cgi?id=1190670

Fixes: https://github.com/actions/virtual-environments/issues/4193

Signed-off-by: Petr Vorel <pvorel@suse.cz>
---
Tested:
https://github.com/pevik/iputils/runs/4020083152?check_suite_focus=true

 .github/workflows/ci.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3ffde8c48..55d8f5eb5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -76,6 +76,11 @@ jobs:
               CC: clang
               METADATA: asciidoc-pdf
 
+          - container: "opensuse/tumbleweed"
+            env:
+              CC: gcc
+              METADATA: asciidoctor
+
           - container: "opensuse/leap"
             env:
               CC: gcc
@@ -110,6 +115,7 @@ jobs:
     container:
       image: ${{ matrix.container }}
       env: ${{ matrix.env }}
+      options: --security-opt seccomp=unconfined
 
     steps:
     - name: Show OS
-- 
2.33.1


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

^ permalink raw reply related	[flat|nested] 6+ messages in thread
* Re: [LTP] [PATCH 1/1] CI: Reenable Tumbleweed
  2021-10-27  9:20 [LTP] [PATCH 1/1] CI: Reenable Tumbleweed Petr Vorel
@ 2021-10-27  9:42 ` Petr Vorel
  2021-10-27  9:52   ` Cyril Hrubis
  0 siblings, 1 reply; 6+ messages in thread
From: Petr Vorel @ 2021-10-27  9:42 UTC (permalink / raw)
  To: ltp

Hi,

<snip>
>      container:
>        image: ${{ matrix.container }}
>        env: ${{ matrix.env }}
> +      options: --security-opt seccomp=unconfined
Alternatively 'options: --privileged' could be used (to run privileged
container), IMHO does not matter which of these we take.

Kind regards,
Petr

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [LTP] [PATCH 1/1] CI: Reenable Tumbleweed
  2021-10-27  9:42 ` Petr Vorel
@ 2021-10-27  9:52   ` Cyril Hrubis
  2021-10-27 10:13     ` Petr Vorel
  0 siblings, 1 reply; 6+ messages in thread
From: Cyril Hrubis @ 2021-10-27  9:52 UTC (permalink / raw)
  To: Petr Vorel; +Cc: ltp

Hi!
> >      container:
> >        image: ${{ matrix.container }}
> >        env: ${{ matrix.env }}
> > +      options: --security-opt seccomp=unconfined
> Alternatively 'options: --privileged' could be used (to run privileged
> container), IMHO does not matter which of these we take.

Looking at docker documentation it looks like --privileged disables much
more than just the seccomp filtering. I do not think that this is a good
idea. Let's go with just disabling seccomp for affected distros.

-- 
Cyril Hrubis
chrubis@suse.cz

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [LTP] [PATCH 1/1] CI: Reenable Tumbleweed
  2021-10-27  9:52   ` Cyril Hrubis
@ 2021-10-27 10:13     ` Petr Vorel
  2021-10-29  8:22       ` Cyril Hrubis
  0 siblings, 1 reply; 6+ messages in thread
From: Petr Vorel @ 2021-10-27 10:13 UTC (permalink / raw)
  To: Cyril Hrubis; +Cc: ltp

> Hi!
> > >      container:
> > >        image: ${{ matrix.container }}
> > >        env: ${{ matrix.env }}
> > > +      options: --security-opt seccomp=unconfined
> > Alternatively 'options: --privileged' could be used (to run privileged
> > container), IMHO does not matter which of these we take.

> Looking at docker documentation it looks like --privileged disables much
> more than just the seccomp filtering. I do not think that this is a good
> idea. Let's go with just disabling seccomp for affected distros.
IMHO both are ok for just compilation (other projects use it as well for just
CI doing compilation), but sure, let's use the minimum.
FYI this disables seccomp for all machines. Is that ok for you?
IMHO that's not a big deal + we will not have to bother when Fedora also gets
new enough glibc (IMHO problem will periodically occurs on bleeding edge distros
when glibc starts to use new enough syscall).

Kind regards,
Petr

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [LTP] [PATCH 1/1] CI: Reenable Tumbleweed
  2021-10-27 10:13     ` Petr Vorel
@ 2021-10-29  8:22       ` Cyril Hrubis
  2021-10-29  9:38         ` Petr Vorel
  0 siblings, 1 reply; 6+ messages in thread
From: Cyril Hrubis @ 2021-10-29  8:22 UTC (permalink / raw)
  To: Petr Vorel; +Cc: ltp

Hi!
> > Looking at docker documentation it looks like --privileged disables much
> > more than just the seccomp filtering. I do not think that this is a good
> > idea. Let's go with just disabling seccomp for affected distros.
> IMHO both are ok for just compilation (other projects use it as well for just
> CI doing compilation), but sure, let's use the minimum.
> FYI this disables seccomp for all machines. Is that ok for you?
> IMHO that's not a big deal + we will not have to bother when Fedora also gets
> new enough glibc (IMHO problem will periodically occurs on bleeding edge distros
> when glibc starts to use new enough syscall).

Anyways:

Acked-by: Cyril Hrubis <chrubis@suse.cz>

For the original patch that disables seccomp.

-- 
Cyril Hrubis
chrubis@suse.cz

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [LTP] [PATCH 1/1] CI: Reenable Tumbleweed
  2021-10-29  8:22       ` Cyril Hrubis
@ 2021-10-29  9:38         ` Petr Vorel
  0 siblings, 0 replies; 6+ messages in thread
From: Petr Vorel @ 2021-10-29  9:38 UTC (permalink / raw)
  To: Cyril Hrubis; +Cc: ltp

Hi Cyril,

> Hi!
> > > Looking at docker documentation it looks like --privileged disables much
> > > more than just the seccomp filtering. I do not think that this is a good
> > > idea. Let's go with just disabling seccomp for affected distros.
> > IMHO both are ok for just compilation (other projects use it as well for just
> > CI doing compilation), but sure, let's use the minimum.
> > FYI this disables seccomp for all machines. Is that ok for you?
> > IMHO that's not a big deal + we will not have to bother when Fedora also gets
> > new enough glibc (IMHO problem will periodically occurs on bleeding edge distros
> > when glibc starts to use new enough syscall).

> Anyways:

> Acked-by: Cyril Hrubis <chrubis@suse.cz>

> For the original patch that disables seccomp.

Thanks, pushed!

Kind regards,
Petr

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2021-10-29  9:39 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-10-27  9:20 [LTP] [PATCH 1/1] CI: Reenable Tumbleweed Petr Vorel
2021-10-27  9:42 ` Petr Vorel
2021-10-27  9:52   ` Cyril Hrubis
2021-10-27 10:13     ` Petr Vorel
2021-10-29  8:22       ` Cyril Hrubis
2021-10-29  9:38         ` Petr Vorel

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.