On 8/29/21 6:52 AM, hongxu wrote:
Since upstream commit [d8ea0d0168 Add an internal wrapper for clone, clone2 and clone3] applied, start a unprivileged container (docker run without --privileged), it creates a thread failed in container. In commit d8ea0d0168, it calls __clone3 if HAVE_CLONE3_WAPPER is defined. If __clone3 returns -1 with ENOSYS, fall back to clone or clone2. As known from [1], cloneXXX fails with EPERM if CLONE_NEWCGROUP, CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, or CLONE_NEWUTS was specified by an unprivileged process (process without CAP_SYS_ADMIN) [1] https://man7.org/linux/man-pages/man2/clone3.2.html So if __clone3 returns -1 with EPERM, fall back to clone or clone2 could fix the issue.
I think this is application issue so perhaps should be fixed in container runtime and not in glibc so fixing glibc here sounds to be wrong approach. You probably should disable clone3 wrapper completely or via tunables when launching the container runtime maybe.
Signed-off-by: Hongxu Jia <[email protected]> --- ...d-failed-in-unprivileged-process-BZ-.patch | 79 +++++++++++++++++++ meta/recipes-core/glibc/glibc_2.34.bb | 1 + 2 files changed, 80 insertions(+) create mode 100644 meta/recipes-core/glibc/glibc/0001-fix-create-thread-failed-in-unprivileged-process-BZ-.patch diff --git a/meta/recipes-core/glibc/glibc/0001-fix-create-thread-failed-in-unprivileged-process-BZ-.patch b/meta/recipes-core/glibc/glibc/0001-fix-create-thread-failed-in-unprivileged-process-BZ-.patch new file mode 100644 index 0000000000..3283dd7ad8 --- /dev/null +++ b/meta/recipes-core/glibc/glibc/0001-fix-create-thread-failed-in-unprivileged-process-BZ-.patch @@ -0,0 +1,79 @@ +From a8bc44936202692edcd82a48c07d7cf27d6ed8ee Mon Sep 17 00:00:00 2001 +From: Hongxu Jia <[email protected]> +Date: Sun, 29 Aug 2021 20:49:16 +0800 +Subject: [PATCH] fix create thread failed in unprivileged process [BZ #28287] + +Since commit [d8ea0d0168 Add an internal wrapper for clone, clone2 and clone3] +applied, start a unprivileged container (docker run without --privileged), +it creates a thread failed in container. + +In commit d8ea0d0168, it calls __clone3 if HAVE_CLONE3_WAPPER is defined. If +__clone3 returns -1 with ENOSYS, fall back to clone or clone2. + +As known from [1], cloneXXX fails with EPERM if CLONE_NEWCGROUP, +CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, or CLONE_NEWUTS +was specified by an unprivileged process (process without CAP_SYS_ADMIN) + +[1] https://man7.org/linux/man-pages/man2/clone3.2.html + +So if __clone3 returns -1 with EPERM, fall back to clone or clone2 could +fix the issue. Here are the test steps: + +1) Prepare test code +cat > conftest.c <<ENDOF + #include <pthread.h> + #include <stdio.h> + +int check_me = 0; +void* func(void* data) {check_me = 42; printf("start thread: check_me %d\n", check_me); return &check_me;} +int main() +{ + pthread_t t; + void *ret; + pthread_create (&t, 0, func, 0); + pthread_join (t, &ret); + printf("check_me %d, p %p\n", check_me, &ret); + return (check_me != 42 || ret != &check_me); +} + +ENDOF + +2) Compile +gcc -o conftest -pthread conftest.c + +3) Start a container with glibc 2.34 installed +[skip details] +docker run -it <container-image-name> bash + +4) Run conftest without this patch +$ ./conftest +check_me 0, p 0x7ffd91ccd400 + +5) Run conftest with this patch +$ ./conftest +start thread: check_me 42 +check_me 42, p 0x7ffe253c6f20 + +Upstream-Status: Submitted [[email protected]] + +Signed-off-by: Hongxu Jia <[email protected]> +--- + sysdeps/unix/sysv/linux/clone-internal.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sysdeps/unix/sysv/linux/clone-internal.c b/sysdeps/unix/sysv/linux/clone-internal.c +index 979f7880be..97101994e8 100644 +--- a/sysdeps/unix/sysv/linux/clone-internal.c ++++ b/sysdeps/unix/sysv/linux/clone-internal.c +@@ -52,7 +52,7 @@ __clone_internal (struct clone_args *cl_args, + /* Try clone3 first. */ + int saved_errno = errno; + ret = __clone3 (cl_args, sizeof (*cl_args), func, arg); +- if (ret != -1 || errno != ENOSYS) ++ if (ret != -1 || (errno != ENOSYS && errno != EPERM)) + return ret; + + /* NB: Restore errno since errno may be checked against non-zero +-- +2.30.2 + diff --git a/meta/recipes-core/glibc/glibc_2.34.bb b/meta/recipes-core/glibc/glibc_2.34.bb index eafc0216ff..6dc315c349 100644 --- a/meta/recipes-core/glibc/glibc_2.34.bb +++ b/meta/recipes-core/glibc/glibc_2.34.bb @@ -57,6 +57,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \ file://0030-powerpc-Do-not-ask-compiler-for-finding-arch.patch \ file://0001-CVE-2021-38604.patch \ file://0002-CVE-2021-38604.patch \ + file://0001-fix-create-thread-failed-in-unprivileged-process-BZ-.patch \ " S = "${WORKDIR}/git" B = "${WORKDIR}/build-${TARGET_SYS}"
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#155462): https://lists.openembedded.org/g/openembedded-core/message/155462 Mute This Topic: https://lists.openembedded.org/mt/85228077/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
