From patchwork Sun Aug 29 13:29:54 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hongxu Jia X-Patchwork-Id: 44804 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id EF8193857017 for ; Sun, 29 Aug 2021 13:30:24 +0000 (GMT) X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from mail1.wrs.com (mail1.windriver.com [147.11.146.13]) by sourceware.org (Postfix) with ESMTPS id 2ED913858403 for ; Sun, 29 Aug 2021 13:30:03 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 2ED913858403 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=windriver.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=windriver.com Received: from mail.windriver.com (mail.wrs.com [147.11.1.11]) by mail1.wrs.com (8.15.2/8.15.2) with ESMTPS id 17TDTtM4023857 (version=TLSv1.1 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Sun, 29 Aug 2021 06:29:55 -0700 Received: from ala-exchng01.corp.ad.wrs.com (ala-exchng01.corp.ad.wrs.com [147.11.82.252]) by mail.windriver.com (8.15.2/8.15.2) with ESMTPS id 17TDTsjp008452 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=FAIL); Sun, 29 Aug 2021 06:29:54 -0700 (PDT) Received: from ALA-EXCHNG02.corp.ad.wrs.com (147.11.82.254) by ala-exchng01.corp.ad.wrs.com (147.11.82.252) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2242.12; Sun, 29 Aug 2021 06:29:54 -0700 Received: from ala-exchng01.corp.ad.wrs.com (147.11.82.252) by ALA-EXCHNG02.corp.ad.wrs.com (147.11.82.254) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2308.14; Sun, 29 Aug 2021 06:29:54 -0700 Received: from ala-lpggp7.wrs.com (147.11.105.171) by ala-exchng01.corp.ad.wrs.com (147.11.82.252) with Microsoft SMTP Server id 15.1.2242.12 via Frontend Transport; Sun, 29 Aug 2021 06:29:54 -0700 From: Hongxu Jia To: Subject: [PATCH] fix create thread failed in unprivileged process [BZ #28287] Date: Sun, 29 Aug 2021 06:29:54 -0700 Message-ID: <20210829132954.18148-1-hongxu.jia@windriver.com> X-Mailer: git-send-email 2.30.2 MIME-Version: 1.0 X-Spam-Status: No, score=-13.3 required=5.0 tests=BAYES_00, GIT_PATCH_0, KAM_DMARC_STATUS, KAM_SHORT, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.4 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: richard.purdie@linuxfoundation.org Errors-To: libc-alpha-bounces+patchwork=sourceware.org@sourceware.org Sender: "Libc-alpha" Since commit [d8ea0d0168 Add an internal wrapper for clone, clone2 and clone3] applied, start a unprivileged container (docker run without --privileged), it creates a thread failed in container. In commit d8ea0d0168, it calls __clone3 if HAVE_CLONE3_WAPPER is defined. If __clone3 returns -1 with ENOSYS, fall back to clone or clone2. As known from [1], cloneXXX fails with EPERM if CLONE_NEWCGROUP, CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, or CLONE_NEWUTS was specified by an unprivileged process (process without CAP_SYS_ADMIN) [1] https://man7.org/linux/man-pages/man2/clone3.2.html So if __clone3 returns -1 with EPERM, fall back to clone or clone2 could fix the issue. Here are the test steps: 1) Prepare test code cat > conftest.c < #include int check_me = 0; void* func(void* data) {check_me = 42; printf("start thread: check_me %d\n", check_me); return &check_me;} int main() { pthread_t t; void *ret; pthread_create (&t, 0, func, 0); pthread_join (t, &ret); printf("check_me %d, p %p\n", check_me, &ret); return (check_me != 42 || ret != &check_me); } ENDOF 2) Compile gcc -o conftest -pthread conftest.c 3) Start a container with glibc 2.34 installed [skip details] docker run -it bash 4) Run conftest without this patch $ ./conftest check_me 0, p 0x7ffd91ccd400 5) Run conftest with this patch $ ./conftest start thread: check_me 42 check_me 42, p 0x7ffe253c6f20 Signed-off-by: Hongxu Jia --- sysdeps/unix/sysv/linux/clone-internal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sysdeps/unix/sysv/linux/clone-internal.c b/sysdeps/unix/sysv/linux/clone-internal.c index 979f7880be..97101994e8 100644 --- a/sysdeps/unix/sysv/linux/clone-internal.c +++ b/sysdeps/unix/sysv/linux/clone-internal.c @@ -52,7 +52,7 @@ __clone_internal (struct clone_args *cl_args, /* Try clone3 first. */ int saved_errno = errno; ret = __clone3 (cl_args, sizeof (*cl_args), func, arg); - if (ret != -1 || errno != ENOSYS) + if (ret != -1 || (errno != ENOSYS && errno != EPERM)) return ret; /* NB: Restore errno since errno may be checked against non-zero