CI: ubuntu-26.04 runners break the i686 and SELinux jobs

Aperta
  • Qualcosa non va?
#15,955 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
38/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
docker, github-actions, linux, rust
Ambito
ci-cd, devops, testing

Direzione di ricerca

Start with the i686 and GNU SELinux CI job definitions and the linked failing runs; compare their runner image versions with the last successful ubuntu-24.04 runs. The report identifies Docker 29.4.2 seccomp behavior as a likely cause of the i686 failures, while the SELinux dnf install failure is still unexplained. Done means identifying and addressing the runner causes so both job groups pass.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

B - high priority

I couldn't find an existing issue for this, so I'm opening one.

ubuntu-latest jobs now sometimes run on ubuntu-26.04 instead of ubuntu-24.04 (kernel 7.0, Docker 29.4.2 instead of kernel 6.17, Docker 28.0.4). Some jobs fail only on the new image.

i686 (cross)

Docker 29.4.2's default seccomp profile returns ERRNO 38 (ENOSYS) for socketcall. This is moby/moby#52506, fixed in Docker 29.4.3, but the ubuntu-26.04 image still pins 29.4.2: actions/runner-images#14790.

  • rustix on x86 does socketpair through socketcall, so test_tr::test_stdin_is_socket fails with os error 38 (musl job).
  • test_localization_and_colors fails to spawn the utility with os error 38 (gnu job). i386 glibc also uses socketcall (see actions/runner-images#14790), so I think it is the same cause.

Example: https://github.com/uutils/coreutils/actions/runs/40689561866/job/122823471942 (gnu) and https://github.com/uutils/coreutils/actions/runs/40689561866/job/122823472059 (musl), from #15953.

I reproduced the tr failure locally: with a seccomp filter that only returns ENOSYS for socketcall, rustix socketpair on i686-unknown-linux-musl fails with os error 38, and works without the filter.

test program

Cargo.toml:

[package]
name = "sockprobe"
version = "0.1.0"
edition = "2021"

[dependencies]
rustix = { version = "=1.1.5", features = ["net"] }
libc = "0.2"

src/main.rs:

use rustix::net::{socketpair, AddressFamily, SocketFlags, SocketType};

// Like Docker 29.4.2: socketcall -> ERRNO 38 (ENOSYS), everything else allowed
fn block_socketcall() {
    const SYS_SOCKETCALL_I386: u32 = 102;
    let mut prog = [
        libc::sock_filter { code: (libc::BPF_LD | libc::BPF_W | libc::BPF_ABS) as u16, jt: 0, jf: 0, k: 0 },
        libc::sock_filter { code: (libc::BPF_JMP | libc::BPF_JEQ | libc::BPF_K) as u16, jt: 0, jf: 1, k: SYS_SOCKETCALL_I386 },
        libc::sock_filter { code: (libc::BPF_RET | libc::BPF_K) as u16, jt: 0, jf: 0, k: libc::SECCOMP_RET_ERRNO | libc::ENOSYS as u32 },
        libc::sock_filter { code: (libc::BPF_RET | libc::BPF_K) as u16, jt: 0, jf: 0, k: libc::SECCOMP_RET_ALLOW },
    ];
    let fprog = libc::sock_fprog { len: prog.len() as u16, filter: prog.as_mut_ptr() };
    unsafe {
        assert_eq!(libc::prctl(libc::PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0), 0);
        assert_eq!(libc::prctl(libc::PR_SET_SECCOMP, libc::SECCOMP_MODE_FILTER, &fprog as *const _), 0);
    }
}

fn main() {
    if std::env::var_os("BLOCK_SOCKETCALL").is_some() {
        block_socketcall();
    }
    // rustix on x86 goes through socketcall(SYS_SOCKETPAIR)
    let r = socketpair(AddressFamily::UNIX, SocketType::STREAM, SocketFlags::empty(), None);
    println!("rustix socketpair: {:?}", r.map(|_| "ok"));
}

$ cargo build --target i686-unknown-linux-musl
$ ./target/i686-unknown-linux-musl/debug/sockprobe
rustix socketpair: Ok("ok")
$ BLOCK_SOCKETCALL=1 ./target/i686-unknown-linux-musl/debug/sockprobe
rustix socketpair: Err(Os { code: 38, kind: Unsupported, message: "Function not implemented" })

This is hidden on main: the build jobs need min_version, and MinRustV currently fails there because of #15937. The last time i686 ran on main (c21b7adc6, ubuntu-24.04) the tests passed.

GNU tests (SELinux)

The last success ran on ubuntu-24.04 (https://github.com/uutils/coreutils/actions/runs/40602187553), the first failure on ubuntu-26.04 (https://github.com/uutils/coreutils/actions/runs/40605824544). dnf install in the lima VM stops after about 30 packages and the step ends with exit code 255. I don't know why yet.

Pinning these jobs to ubuntu-24.04 might work until the runner image gets Docker 29.4.3.

Lingua principale
Rust
Stelle
24.3k
Fork
2.1k
Merge medio
2g 7h
PR unite (30g)
397

Preparare l'ambiente

Apri in Codespaces

Avvia il container di sviluppo del progetto nel browser, con il tuo account GitHub.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di uutils/coreutils

Tutte le issue di uutils/coreutils

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.