This bug was fixed in the package systemd - 237-3ubuntu10.46
---------------
systemd (237-3ubuntu10.46) bionic; urgency=medium
* d/p/lp1916485-Newer-Glibc-use-faccessat2-to-implement-faccessat.patch:
Add support for faccessat2 (LP: #1916485)
https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=b5f11a9baecf0cefb503632e938d473234172128
* d/p/lp1918696-shared-seccomp-util-address-family-filtering-is-brok.patch:
Stop attempting to restrict address families on ppc archs
(LP: #1918696)
https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=4569a047ece8b1b300ef63e49b5aea8aba35c500
* d/p/lp1891810-seccomp-util-add-new-syscalls-from-kernel-5.6-to-sys.patch:
Add openat2() syscall to seccomp filter list
(LP: #1891810)
https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=2ddfbfa79af4f22b7adf946c4299433fd74a4f17
-- Dan Streetman <ddstr...@canonical.com> Wed, 17 Mar 2021 17:38:05
-0400
** Changed in: systemd (Ubuntu Bionic)
Status: Fix Committed => Fix Released
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to systemd in Ubuntu.
https://bugs.launchpad.net/bugs/1891810
Title:
Backport 2.5.1 to fix missing openat2 syscall, causing problems for
fuse-overlayfs in nspawn containers
Status in libseccomp package in Ubuntu:
Fix Released
Status in systemd package in Ubuntu:
Fix Released
Status in libseccomp source package in Xenial:
Fix Released
Status in systemd source package in Xenial:
Invalid
Status in libseccomp source package in Bionic:
Fix Released
Status in systemd source package in Bionic:
Fix Released
Status in libseccomp source package in Focal:
Fix Released
Status in systemd source package in Focal:
Fix Released
Status in libseccomp source package in Groovy:
Fix Released
Status in systemd source package in Groovy:
Fix Released
Status in libseccomp source package in Hirsute:
Fix Released
Status in systemd source package in Hirsute:
Fix Released
Bug description:
[Impact]
The version of libseccomp2 in X/B/F/G does not know about the openat2
syscall. As such applications that use libseccomp cannot specify a
system-call filter against this system-call and so it cannot be
mediated.
[Test Plan]
This can be tested by simply running scmp_sys_resolver from the
seccomp binary package and specifying this system-call:
Existing behaviour:
$ scmp_sys_resolver openat2
-1
Expected behaviour:
$ scmp_sys_resolver openat2
437
(Note this value will be different on other architectures)
[Where problems could occur]
In version 2.5.1 of libseccomp which adds this new system-call,
changes were also made in the way the socket system-call is handled by
libseccomp on PPC platforms - this resulted in a change in the
expected behaviour and so this has already been noticed and a fix is
required for the systemd unit tests as a result
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1918696
There was also a similar change for s390x but so far no regressions
have been observed as a result as systemd already expected that
behaviour from libseccomp, it was only PPC that was missing.
In the event that a regression is observed however, we can easily
either patch the affected package to cope with the new behaviour of
this updated libseccomp since in each case the change in behaviour
only affects a few system calls on particular architectures, or we can
revert this update.
[Other Info]
* As usual thorough testing of this update has been performed both
manually via the QA Regression Testing scripts, and via the
autopkgtest infrastructure against packages in the Ubuntu Security
Proposed PPA https://launchpad.net/~ubuntu-security-
proposed/+archive/ubuntu/ppa/ with results seen
https://people.canonical.com/~platform/security-britney/current/
I have attached debdiffs of the prepared updates which are also
sitting in the Ubuntu Security Proposed PPA.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libseccomp/+bug/1891810/+subscriptions
--
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help : https://help.launchpad.net/ListHelp
