Linux-man Archive on
 help / color / Atom feed
From: Florian Weimer <>
To: Szabolcs Nagy <>
Cc: Adhemerval Zanella <>,
	"libc-alpha\" <>,
	nd <>, linux-man <>
Subject: Re: glibc in master is incompatible with systemd-nspawn
Date: Fri, 08 Nov 2019 17:19:47 +0100
Message-ID: <> (raw)
In-Reply-To: <> (Szabolcs Nagy's message of "Fri, 8 Nov 2019 16:01:58 +0000")

* Szabolcs Nagy:

> it's of course broken whenever the application is
> run on a newer kernel+libc than what was used for
> creating the filter, may be the seccomp manual should
> warn against the use of EPERM (there is already a
> caveats section)?

On this topic (ENOSYS vs PERM), I wrote earlier today:

| They serve different purposes. EPERM is appropriate if you want things
| to fail (so that applications break), ENOSYS is appropriate if you
| want to trigger fallback (like utimensat_time64 → utime) or just
| disable the feature (because the application assumes the kernel is too
| old to support it). For a generic container runtime, there either have
| to be no filters by default (my preference), or filters for unknown
| system calls need to return ENOSYS. Everything else will break too
| many applications.
| If you have specific knowledge of the system call, you can return
| EPERM instead in a few cases (e.g. for clock_settime). But that's not
| really possible for an unknown system call.


I don't know how controversial this position is.  People seem rather
opinionated about EPERM.


  reply index

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <>
     [not found] ` <>
     [not found]   ` <>
     [not found]     ` <>
2019-11-08 16:01       ` Szabolcs Nagy
2019-11-08 16:19         ` Florian Weimer [this message]
2019-11-08 16:23           ` Christian Brauner

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-man Archive on

Archives are clonable:
	git clone --mirror linux-man/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-man linux-man/ \
	public-inbox-index linux-man

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone