Bug 33189

Summary: Please enable seccomp on armv7hl
Product: Mageia Reporter: Jybz <j.biernacki+mga>
Component: RPM PackagesAssignee: Kernel and Drivers maintainers <kernel>
Status: NEW --- QA Contact:
Severity: normal    
Priority: Normal    
Version: 9   
Target Milestone: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Source RPM: kernel CVE:
Status comment:

Description Jybz 2024-05-10 05:40:40 CEST
Hello,

podman is not working on armv7hl, I'm trying to debug and the first element that came to me is that secomp is not enable on armv7hl:

$ arch
armv7l
$ grep -Rin seccomp /boot/config-6.6.18-desktop-1.mga9 
812:CONFIG_HAVE_ARCH_SECCOMP=y
813:# CONFIG_SECCOMP is not set

$ arch
x86_64
$ grep -Rin seccomp /boot/config-6.6.28-desktop-1.mga9 
856:CONFIG_HAVE_ARCH_SECCOMP=y
857:CONFIG_HAVE_ARCH_SECCOMP_FILTER=y
858:CONFIG_SECCOMP=y
859:CONFIG_SECCOMP_FILTER=y
860:# CONFIG_SECCOMP_CACHE_DEBUG is not set

$ arch
aarch64
$ grep -Rin seccomp /boot/config-6.6.18-desktop-1.mga9 
770:CONFIG_HAVE_ARCH_SECCOMP=y
771:CONFIG_HAVE_ARCH_SECCOMP_FILTER=y
772:CONFIG_SECCOMP=y
773:CONFIG_SECCOMP_FILTER=y
774:# CONFIG_SECCOMP_CACHE_DEBUG is not set

Output of podman:
podman run hello-world
Error: /usr/bin/slirp4netns failed: "sent tapfd=7 for tap0\nWARNING: Support for seccomp is experimental\nWARNING: Support for IPv6 is experimental\nreceived tapfd=7\nseccomp: seccomp_load(): Operation canceled\nenable_seccomp failed\ndo_slirp is exiting\ndo_slirp failed\nparent failed\nWARNING: Support for seccomp is experimental\nWARNING: Support for IPv6 is experimental\nStarting slirp\n* MTU:             65520\n* Network:         10.0.2.0\n* Netmask:         255.255.255.0\n* Gateway:         10.0.2.2\n* DNS:             10.0.2.3\n* DHCP begin:      10.0.2.15\n* DHCP end:        10.0.2.30\n* Recommended IP:  10.0.2.100\n"

We can read in the middle:
seccomp: seccomp_load(): Operation canceled
enable_seccomp failed
Comment 1 Jybz 2024-05-10 05:54:18 CEST
Dig further: /usr/share/containers/seccomp.json
contains a list of arch, but no armv7 :D
Comment 2 Lewis Smith 2024-05-12 21:04:23 CEST
Thank you for the clearly substantiated report.

Assigning to kernel.

Assignee: bugsquad => kernel