+seccomp maintainers/reviewers [thread context is at https://lore.kernel.org/linux-api/87lfer2c0b.fsf@xxxxxxxxxxxxxxxxxxxxxxxxx/ ] On Tue, Nov 24, 2020 at 5:49 PM Christoph Hellwig <hch@xxxxxxxxxxxxx> wrote: > On Tue, Nov 24, 2020 at 03:08:05PM +0100, Mark Wielaard wrote: > > For valgrind the issue is statx which we try to use before falling back > > to stat64, fstatat or stat (depending on architecture, not all define > > all of these). The problem with these fallbacks is that under some > > containers (libseccomp versions) they might return EPERM instead of > > ENOSYS. This causes really obscure errors that are really hard to > > diagnose. > > So find a way to detect these completely broken container run times > and refuse to run under them at all. After all they've decided to > deliberately break the syscall ABI. (and yes, we gave the the rope > to do that with seccomp :(). FWIW, if the consensus is that seccomp filters that return -EPERM by default are categorically wrong, I think it should be fairly easy to add a check to the seccomp core that detects whether the installed filter returns EPERM for some fixed unused syscall number and, if so, prints a warning to dmesg or something along those lines...
