From: Aleksa Sarai <cyphar@cyphar.com>
To: Florian Weimer <fweimer@redhat.com>
Cc: Szabolcs Nagy <szabolcs.nagy@arm.com>,
Christian Brauner <christian.brauner@ubuntu.com>,
Florian Weimer via Libc-alpha <libc-alpha@sourceware.org>
Subject: Re: RFC: Disable clone3 for glibc 2.34
Date: Fri, 30 Jul 2021 22:16:17 +1000 [thread overview]
Message-ID: <20210730121617.hroekeifiexefqrn@senku> (raw)
In-Reply-To: <87lf5p2y2q.fsf@oldenburg.str.redhat.com>
[-- Attachment #1: Type: text/plain, Size: 979 bytes --]
On 2021-07-29, Florian Weimer <fweimer@redhat.com> wrote:
> * Aleksa Sarai:
>
> > If you update your syscall profile without knowing what you're doing,
> > things will break. That will always be the case.
>
> But with the current syscall number dependency, this is jusy *way* too
> hard. Who would think that adding close_range (#436) to the policy
> would switch clone3 (#435) from ENOSYS to ENOPERM?
Yeah, I expected that the Docker folks would've been aware of this when
updating the profile (the maintainers were aware of the runc change at
the time) so it does seem this is a bit too complicated...
I think changing this to one of the older versions of the feature I had
(only EPERM for syscalls that were present in Linux 3.0) is probably
less likely to cause confusion, until we have the whole minimum kernel
version infrastructure I mentioned.
--
Aleksa Sarai
Senior Software Engineer (Containers)
SUSE Linux GmbH
<https://www.cyphar.com/>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
next prev parent reply other threads:[~2021-07-30 12:17 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-27 8:43 RFC: Disable clone3 for glibc 2.34 Florian Weimer via Libc-alpha
2021-07-27 9:11 ` Florian Weimer via Libc-alpha
2021-07-27 9:24 ` Christian Brauner
2021-07-27 9:41 ` Christian Brauner
2021-07-27 10:22 ` Aleksa Sarai
2021-07-27 10:48 ` Szabolcs Nagy via Libc-alpha
2021-07-29 8:56 ` Aleksa Sarai
2021-07-29 10:50 ` Florian Weimer via Libc-alpha
2021-07-30 12:16 ` Aleksa Sarai [this message]
2021-07-29 11:38 ` Szabolcs Nagy via Libc-alpha
2021-07-30 15:08 ` Aleksa Sarai
2021-07-28 17:44 ` Florian Weimer via Libc-alpha
2021-07-29 8:36 ` Daniel P. Berrangé via Libc-alpha
2021-07-27 23:07 ` Andreas K. Huettel via Libc-alpha
2021-07-28 4:58 ` Florian Weimer via Libc-alpha
2021-07-28 17:22 ` [PATCH] Typo: Rename HAVE_CLONE3_WAPPER to HAVE_CLONE3_WRAPPER H.J. Lu via Libc-alpha
2021-07-28 17:35 ` Adhemerval Zanella via Libc-alpha
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://www.gnu.org/software/libc/involved.html
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210730121617.hroekeifiexefqrn@senku \
--to=cyphar@cyphar.com \
--cc=christian.brauner@ubuntu.com \
--cc=fweimer@redhat.com \
--cc=libc-alpha@sourceware.org \
--cc=szabolcs.nagy@arm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).