From: Hongxu Jia <hongxu.jia@windriver.com>
To: <libc-alpha@sourceware.org>
Cc: <adhemerval.zanella@linaro.org>, <hjl.tools@gmail.com>,
<richard.purdie@linuxfoundation.org>
Subject: [PATCH] fix create thread failed in unprivileged process [BZ #28287]
Date: Sun, 29 Aug 2021 06:29:54 -0700 [thread overview]
Message-ID: <20210829132954.18148-1-hongxu.jia@windriver.com> (raw)
Since commit [d8ea0d0168 Add an internal wrapper for clone, clone2 and clone3]
applied, start a unprivileged container (docker run without --privileged),
it creates a thread failed in container.
In commit d8ea0d0168, it calls __clone3 if HAVE_CLONE3_WAPPER is defined. If
__clone3 returns -1 with ENOSYS, fall back to clone or clone2.
As known from [1], cloneXXX fails with EPERM if CLONE_NEWCGROUP,
CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, or CLONE_NEWUTS
was specified by an unprivileged process (process without CAP_SYS_ADMIN)
[1] https://man7.org/linux/man-pages/man2/clone3.2.html
So if __clone3 returns -1 with EPERM, fall back to clone or clone2 could
fix the issue. Here are the test steps:
1) Prepare test code
cat > conftest.c <<ENDOF
#include <pthread.h>
#include <stdio.h>
int check_me = 0;
void* func(void* data) {check_me = 42; printf("start thread: check_me %d\n", check_me); return &check_me;}
int main()
{
pthread_t t;
void *ret;
pthread_create (&t, 0, func, 0);
pthread_join (t, &ret);
printf("check_me %d, p %p\n", check_me, &ret);
return (check_me != 42 || ret != &check_me);
}
ENDOF
2) Compile
gcc -o conftest -pthread conftest.c
3) Start a container with glibc 2.34 installed
[skip details]
docker run -it <container-image-name> bash
4) Run conftest without this patch
$ ./conftest
check_me 0, p 0x7ffd91ccd400
5) Run conftest with this patch
$ ./conftest
start thread: check_me 42
check_me 42, p 0x7ffe253c6f20
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
---
sysdeps/unix/sysv/linux/clone-internal.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sysdeps/unix/sysv/linux/clone-internal.c b/sysdeps/unix/sysv/linux/clone-internal.c
index 979f7880be..97101994e8 100644
--- a/sysdeps/unix/sysv/linux/clone-internal.c
+++ b/sysdeps/unix/sysv/linux/clone-internal.c
@@ -52,7 +52,7 @@ __clone_internal (struct clone_args *cl_args,
/* Try clone3 first. */
int saved_errno = errno;
ret = __clone3 (cl_args, sizeof (*cl_args), func, arg);
- if (ret != -1 || errno != ENOSYS)
+ if (ret != -1 || (errno != ENOSYS && errno != EPERM))
return ret;
/* NB: Restore errno since errno may be checked against non-zero
--
2.30.2
next reply other threads:[~2021-08-29 13:30 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-29 13:29 Hongxu Jia [this message]
2021-08-29 13:47 ` H.J. Lu
2021-08-29 14:12 ` Hongxu Jia
2021-08-29 14:43 ` H.J. Lu
2021-08-29 14:50 ` Hongxu Jia
2021-08-29 15:20 ` H.J. Lu
2021-08-29 16:03 ` Hongxu Jia
2021-08-29 16:57 ` H.J. Lu
2021-08-29 14:46 ` Hongxu Jia
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210829132954.18148-1-hongxu.jia@windriver.com \
--to=hongxu.jia@windriver.com \
--cc=adhemerval.zanella@linaro.org \
--cc=hjl.tools@gmail.com \
--cc=libc-alpha@sourceware.org \
--cc=richard.purdie@linuxfoundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).