[Bug 1891810] Re: Missing openat2 syscall, causes problems for fuse-overlayfs in nspawn containers
Launchpad Bug Tracker
1891810 at bugs.launchpad.net
Mon Mar 15 08:17:23 UTC 2021
Status changed to 'Confirmed' because the bug affects multiple users.
** Changed in: libseccomp (Ubuntu Xenial)
Status: New => Confirmed
--
You received this bug notification because you are a member of Ubuntu
Sponsors Team, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/1891810
Title:
Missing openat2 syscall, causes problems for fuse-overlayfs in nspawn
containers
Status in libseccomp package in Ubuntu:
Fix Released
Status in libseccomp source package in Xenial:
Confirmed
Status in libseccomp source package in Bionic:
Confirmed
Status in libseccomp source package in Focal:
Confirmed
Status in libseccomp source package in Groovy:
Confirmed
Status in libseccomp source package in Hirsute:
Fix Released
Bug description:
[Impact]
The version of libseccomp2 in X/B/F/G does not know about the openat2
syscall. As such applications that use libseccomp cannot specify a
system-call filter against this system-call and so it cannot be
mediated.
[Test Plan]
This can be tested by simply running scmp_sys_resolver from the
seccomp binary package and specifying this system-call:
Existing behaviour:
$ scmp_sys_resolver openat2
-1
Expected behaviour:
$ scmp_sys_resolver openat2
437
(Note this value will be different on other architectures)
[Where problems could occur]
In version 2.5.1 of libseccomp which adds this new system-call,
changes were also made in the way the socket system-call is handled by
libseccomp on PPC platforms - this resulted in a change in the
expected behaviour and so this has already been noticed and a fix is
required for the systemd unit tests as a result
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1918696
There was also a similar change for s390x but so far no regressions
have been observed as a result as systemd already expected that
behaviour from libseccomp, it was only PPC that was missing.
In the event that a regression is observed however, we can easily
either patch the affected package to cope with the new behaviour of
this updated libseccomp since in each case the change in behaviour
only affects a few system calls on particular architectures, or we can
revert this update.
[Other Info]
* As usual thorough testing of this update has been performed both
manually via the QA Regression Testing scripts, and via the
autopkgtest infrastructure against packages in the Ubuntu Security
Proposed PPA https://launchpad.net/~ubuntu-security-
proposed/+archive/ubuntu/ppa/ with results seen
https://people.canonical.com/~platform/security-britney/current/
I have attached debdiffs of the prepared updates which are also
sitting in the Ubuntu Security Proposed PPA.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libseccomp/+bug/1891810/+subscriptions
More information about the Ubuntu-sponsors
mailing list