mirror of
https://passt.top/passt
synced 2025-05-19 07:55:34 +02:00
d0006fa784
In the podman CI I noticed many seccomp denials in our logs even though tests passed: comm="pasta.avx2" exe="/usr/bin/pasta.avx2" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb3d31f69db code=0x80000000 Which is futex being called and blocked by the pasta profile. After a few tries I managed to reproduce locally with this loop in ~20 min: while :; do podman run -d --network bridge quay.io/libpod/testimage:20241011 \ sleep 100 && \ sleep 10 && \ podman rm -fa -t0 done And using a pasta version with prctl(PR_SET_DUMPABLE, 1); set I got the following stack trace: Stack trace of thread 1: #0 0x00007fc95e6de91b __lll_lock_wait_private (libc.so.6 + 0x9491b) #1 0x00007fc95e68d6de __run_exit_handlers (libc.so.6 + 0x436de) #2 0x00007fc95e68d70e exit (libc.so.6 + 0x4370e) #3 0x000055f31b78c50b n/a (n/a + 0x0) #4 0x00007fc95e68d70e exit (libc.so.6 + 0x4370e) #5 0x000055f31b78d5a2 n/a (n/a + 0x0) Pasta got killed in exit(), it seems glibc is trying to use a lock when running exit handlers even though no exit handlers are defined. Given no exit handlers are needed we can call _exit() instead. This skips exit handlers and does not flush stdio streams compared to exit() which should be fine for the use here. Based on the input from Stefano I did not change the test/doc programs or qrap as they do not use seccomp filters. Signed-off-by: Paul Holzinger <pholzing@redhat.com> Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
61 lines
1.9 KiB
C
61 lines
1.9 KiB
C
/* SPDX-License-Identifier: GPL-2.0-or-later
|
|
* Copyright (c) 2022 Red Hat GmbH
|
|
* Author: Stefano Brivio <sbrivio@redhat.com>
|
|
*/
|
|
|
|
#ifndef LOG_H
|
|
#define LOG_H
|
|
|
|
#include <stdbool.h>
|
|
#include <syslog.h>
|
|
|
|
#define LOGFILE_SIZE_DEFAULT (1024 * 1024UL)
|
|
#define LOGFILE_CUT_RATIO 30 /* When full, cut ~30% size */
|
|
#define LOGFILE_SIZE_MIN (5UL * MAX(BUFSIZ, PAGE_SIZE))
|
|
|
|
void vlogmsg(bool newline, bool cont, int pri, const char *format, va_list ap);
|
|
void logmsg(bool newline, bool cont, int pri, const char *format, ...)
|
|
__attribute__((format(printf, 4, 5)));
|
|
void logmsg_perror(int pri, const char *format, ...)
|
|
__attribute__((format(printf, 2, 3)));
|
|
|
|
#define err(...) logmsg(true, false, LOG_ERR, __VA_ARGS__)
|
|
#define warn(...) logmsg(true, false, LOG_WARNING, __VA_ARGS__)
|
|
#define info(...) logmsg(true, false, LOG_INFO, __VA_ARGS__)
|
|
#define debug(...) logmsg(true, false, LOG_DEBUG, __VA_ARGS__)
|
|
|
|
#define err_perror(...) logmsg_perror( LOG_ERR, __VA_ARGS__)
|
|
#define warn_perror(...) logmsg_perror( LOG_WARNING, __VA_ARGS__)
|
|
#define info_perror(...) logmsg_perror( LOG_INFO, __VA_ARGS__)
|
|
#define debug_perror(...) logmsg_perror( LOG_DEBUG, __VA_ARGS__)
|
|
|
|
#define die(...) \
|
|
do { \
|
|
err(__VA_ARGS__); \
|
|
_exit(EXIT_FAILURE); \
|
|
} while (0)
|
|
|
|
#define die_perror(...) \
|
|
do { \
|
|
err_perror(__VA_ARGS__); \
|
|
_exit(EXIT_FAILURE); \
|
|
} while (0)
|
|
|
|
extern int log_trace;
|
|
extern bool log_conf_parsed;
|
|
extern bool log_stderr;
|
|
extern struct timespec log_start;
|
|
|
|
void trace_init(int enable);
|
|
#define trace(...) \
|
|
do { \
|
|
if (log_trace) \
|
|
debug(__VA_ARGS__); \
|
|
} while (0)
|
|
|
|
void __openlog(const char *ident, int option, int facility);
|
|
void logfile_init(const char *name, const char *path, size_t size);
|
|
void passt_vsyslog(bool newline, int pri, const char *format, va_list ap);
|
|
void __setlogmask(int mask);
|
|
|
|
#endif /* LOG_H */
|