0001-fix-create-thread-failed-in-unprivileged-process-BZ-.patch 2.5 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879
  1. From a8bc44936202692edcd82a48c07d7cf27d6ed8ee Mon Sep 17 00:00:00 2001
  2. From: Hongxu Jia <hongxu.jia@windriver.com>
  3. Date: Sun, 29 Aug 2021 20:49:16 +0800
  4. Subject: [PATCH] fix create thread failed in unprivileged process [BZ #28287]
  5. Since commit [d8ea0d0168 Add an internal wrapper for clone, clone2 and clone3]
  6. applied, start a unprivileged container (docker run without --privileged),
  7. it creates a thread failed in container.
  8. In commit d8ea0d0168, it calls __clone3 if HAVE_CLONE3_WAPPER is defined. If
  9. __clone3 returns -1 with ENOSYS, fall back to clone or clone2.
  10. As known from [1], cloneXXX fails with EPERM if CLONE_NEWCGROUP,
  11. CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, or CLONE_NEWUTS
  12. was specified by an unprivileged process (process without CAP_SYS_ADMIN)
  13. [1] https://man7.org/linux/man-pages/man2/clone3.2.html
  14. So if __clone3 returns -1 with EPERM, fall back to clone or clone2 could
  15. fix the issue. Here are the test steps:
  16. 1) Prepare test code
  17. cat > conftest.c <<ENDOF
  18. #include <pthread.h>
  19. #include <stdio.h>
  20. int check_me = 0;
  21. void* func(void* data) {check_me = 42; printf("start thread: check_me %d\n", check_me); return &check_me;}
  22. int main()
  23. {
  24. pthread_t t;
  25. void *ret;
  26. pthread_create (&t, 0, func, 0);
  27. pthread_join (t, &ret);
  28. printf("check_me %d, p %p\n", check_me, &ret);
  29. return (check_me != 42 || ret != &check_me);
  30. }
  31. ENDOF
  32. 2) Compile
  33. gcc -o conftest -pthread conftest.c
  34. 3) Start a container with glibc 2.34 installed
  35. [skip details]
  36. docker run -it <container-image-name> bash
  37. 4) Run conftest without this patch
  38. $ ./conftest
  39. check_me 0, p 0x7ffd91ccd400
  40. 5) Run conftest with this patch
  41. $ ./conftest
  42. start thread: check_me 42
  43. check_me 42, p 0x7ffe253c6f20
  44. Upstream-Status: Submitted [libc-alpha@sourceware.org]
  45. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
  46. ---
  47. sysdeps/unix/sysv/linux/clone-internal.c | 2 +-
  48. 1 file changed, 1 insertion(+), 1 deletion(-)
  49. diff --git a/sysdeps/unix/sysv/linux/clone-internal.c b/sysdeps/unix/sysv/linux/clone-internal.c
  50. index 979f7880be..97101994e8 100644
  51. --- a/sysdeps/unix/sysv/linux/clone-internal.c
  52. +++ b/sysdeps/unix/sysv/linux/clone-internal.c
  53. @@ -52,7 +52,7 @@ __clone_internal (struct clone_args *cl_args,
  54. /* Try clone3 first. */
  55. int saved_errno = errno;
  56. ret = __clone3 (cl_args, sizeof (*cl_args), func, arg);
  57. - if (ret != -1 || errno != ENOSYS)
  58. + if (ret != -1 || (errno != ENOSYS && errno != EPERM))
  59. return ret;
  60. /* NB: Restore errno since errno may be checked against non-zero
  61. --
  62. 2.30.2