CI: ubuntu-26.04 runners break the i686 and SELinux jobs

Abierto
  • ¿Algo no está bien?
#15,955 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
38/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
docker, github-actions, linux, rust
Área
ci-cd, devops, testing

Línea de trabajo

Start with the i686 and GNU SELinux CI job definitions and the linked failing runs; compare their runner image versions with the last successful ubuntu-24.04 runs. The report identifies Docker 29.4.2 seccomp behavior as a likely cause of the i686 failures, while the SELinux dnf install failure is still unexplained. Done means identifying and addressing the runner causes so both job groups pass.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

B - high priority

I couldn't find an existing issue for this, so I'm opening one.

ubuntu-latest jobs now sometimes run on ubuntu-26.04 instead of ubuntu-24.04 (kernel 7.0, Docker 29.4.2 instead of kernel 6.17, Docker 28.0.4). Some jobs fail only on the new image.

i686 (cross)

Docker 29.4.2's default seccomp profile returns ERRNO 38 (ENOSYS) for socketcall. This is moby/moby#52506, fixed in Docker 29.4.3, but the ubuntu-26.04 image still pins 29.4.2: actions/runner-images#14790.

  • rustix on x86 does socketpair through socketcall, so test_tr::test_stdin_is_socket fails with os error 38 (musl job).
  • test_localization_and_colors fails to spawn the utility with os error 38 (gnu job). i386 glibc also uses socketcall (see actions/runner-images#14790), so I think it is the same cause.

Example: https://github.com/uutils/coreutils/actions/runs/40689561866/job/122823471942 (gnu) and https://github.com/uutils/coreutils/actions/runs/40689561866/job/122823472059 (musl), from #15953.

I reproduced the tr failure locally: with a seccomp filter that only returns ENOSYS for socketcall, rustix socketpair on i686-unknown-linux-musl fails with os error 38, and works without the filter.

test program

Cargo.toml:

[package]
name = "sockprobe"
version = "0.1.0"
edition = "2021"

[dependencies]
rustix = { version = "=1.1.5", features = ["net"] }
libc = "0.2"

src/main.rs:

use rustix::net::{socketpair, AddressFamily, SocketFlags, SocketType};

// Like Docker 29.4.2: socketcall -> ERRNO 38 (ENOSYS), everything else allowed
fn block_socketcall() {
    const SYS_SOCKETCALL_I386: u32 = 102;
    let mut prog = [
        libc::sock_filter { code: (libc::BPF_LD | libc::BPF_W | libc::BPF_ABS) as u16, jt: 0, jf: 0, k: 0 },
        libc::sock_filter { code: (libc::BPF_JMP | libc::BPF_JEQ | libc::BPF_K) as u16, jt: 0, jf: 1, k: SYS_SOCKETCALL_I386 },
        libc::sock_filter { code: (libc::BPF_RET | libc::BPF_K) as u16, jt: 0, jf: 0, k: libc::SECCOMP_RET_ERRNO | libc::ENOSYS as u32 },
        libc::sock_filter { code: (libc::BPF_RET | libc::BPF_K) as u16, jt: 0, jf: 0, k: libc::SECCOMP_RET_ALLOW },
    ];
    let fprog = libc::sock_fprog { len: prog.len() as u16, filter: prog.as_mut_ptr() };
    unsafe {
        assert_eq!(libc::prctl(libc::PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0), 0);
        assert_eq!(libc::prctl(libc::PR_SET_SECCOMP, libc::SECCOMP_MODE_FILTER, &fprog as *const _), 0);
    }
}

fn main() {
    if std::env::var_os("BLOCK_SOCKETCALL").is_some() {
        block_socketcall();
    }
    // rustix on x86 goes through socketcall(SYS_SOCKETPAIR)
    let r = socketpair(AddressFamily::UNIX, SocketType::STREAM, SocketFlags::empty(), None);
    println!("rustix socketpair: {:?}", r.map(|_| "ok"));
}

$ cargo build --target i686-unknown-linux-musl
$ ./target/i686-unknown-linux-musl/debug/sockprobe
rustix socketpair: Ok("ok")
$ BLOCK_SOCKETCALL=1 ./target/i686-unknown-linux-musl/debug/sockprobe
rustix socketpair: Err(Os { code: 38, kind: Unsupported, message: "Function not implemented" })

This is hidden on main: the build jobs need min_version, and MinRustV currently fails there because of #15937. The last time i686 ran on main (c21b7adc6, ubuntu-24.04) the tests passed.

GNU tests (SELinux)

The last success ran on ubuntu-24.04 (https://github.com/uutils/coreutils/actions/runs/40602187553), the first failure on ubuntu-26.04 (https://github.com/uutils/coreutils/actions/runs/40605824544). dnf install in the lima VM stops after about 30 packages and the step ends with exit code 255. I don't know why yet.

Pinning these jobs to ubuntu-24.04 might work until the runner image gets Docker 29.4.3.

Lenguaje dominante
Rust
Estrellas
24.3k
Forks
2.1k
Merge medio
2 d 7 h
PR fusionados (30 d)
397

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de uutils/coreutils

Todos los issues de uutils/coreutils

Issues similares

Más issues de Rust

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.