CI: ubuntu-26.04 runners break the i686 and SELinux jobs

未关闭
  • 哪里不对？
#15,955 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
38/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
活跃
技术栈
docker, github-actions, linux, rust
领域
ci-cd, devops, testing

调研方向

Start with the i686 and GNU SELinux CI job definitions and the linked failing runs; compare their runner image versions with the last successful ubuntu-24.04 runs. The report identifies Docker 29.4.2 seccomp behavior as a likely cause of the i686 failures, while the SELinux dnf install failure is still unexplained. Done means identifying and addressing the runner causes so both job groups pass.

由索引模型根据 Issue 内容生成。

描述

B - high priority

I couldn't find an existing issue for this, so I'm opening one.

ubuntu-latest jobs now sometimes run on ubuntu-26.04 instead of ubuntu-24.04 (kernel 7.0, Docker 29.4.2 instead of kernel 6.17, Docker 28.0.4). Some jobs fail only on the new image.

i686 (cross)

Docker 29.4.2's default seccomp profile returns ERRNO 38 (ENOSYS) for socketcall. This is moby/moby#52506, fixed in Docker 29.4.3, but the ubuntu-26.04 image still pins 29.4.2: actions/runner-images#14790.

  • rustix on x86 does socketpair through socketcall, so test_tr::test_stdin_is_socket fails with os error 38 (musl job).
  • test_localization_and_colors fails to spawn the utility with os error 38 (gnu job). i386 glibc also uses socketcall (see actions/runner-images#14790), so I think it is the same cause.

Example: https://github.com/uutils/coreutils/actions/runs/40689561866/job/122823471942 (gnu) and https://github.com/uutils/coreutils/actions/runs/40689561866/job/122823472059 (musl), from #15953.

I reproduced the tr failure locally: with a seccomp filter that only returns ENOSYS for socketcall, rustix socketpair on i686-unknown-linux-musl fails with os error 38, and works without the filter.

test program

Cargo.toml:

[package]
name = "sockprobe"
version = "0.1.0"
edition = "2021"

[dependencies]
rustix = { version = "=1.1.5", features = ["net"] }
libc = "0.2"

src/main.rs:

use rustix::net::{socketpair, AddressFamily, SocketFlags, SocketType};

// Like Docker 29.4.2: socketcall -> ERRNO 38 (ENOSYS), everything else allowed
fn block_socketcall() {
    const SYS_SOCKETCALL_I386: u32 = 102;
    let mut prog = [
        libc::sock_filter { code: (libc::BPF_LD | libc::BPF_W | libc::BPF_ABS) as u16, jt: 0, jf: 0, k: 0 },
        libc::sock_filter { code: (libc::BPF_JMP | libc::BPF_JEQ | libc::BPF_K) as u16, jt: 0, jf: 1, k: SYS_SOCKETCALL_I386 },
        libc::sock_filter { code: (libc::BPF_RET | libc::BPF_K) as u16, jt: 0, jf: 0, k: libc::SECCOMP_RET_ERRNO | libc::ENOSYS as u32 },
        libc::sock_filter { code: (libc::BPF_RET | libc::BPF_K) as u16, jt: 0, jf: 0, k: libc::SECCOMP_RET_ALLOW },
    ];
    let fprog = libc::sock_fprog { len: prog.len() as u16, filter: prog.as_mut_ptr() };
    unsafe {
        assert_eq!(libc::prctl(libc::PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0), 0);
        assert_eq!(libc::prctl(libc::PR_SET_SECCOMP, libc::SECCOMP_MODE_FILTER, &fprog as *const _), 0);
    }
}

fn main() {
    if std::env::var_os("BLOCK_SOCKETCALL").is_some() {
        block_socketcall();
    }
    // rustix on x86 goes through socketcall(SYS_SOCKETPAIR)
    let r = socketpair(AddressFamily::UNIX, SocketType::STREAM, SocketFlags::empty(), None);
    println!("rustix socketpair: {:?}", r.map(|_| "ok"));
}

$ cargo build --target i686-unknown-linux-musl
$ ./target/i686-unknown-linux-musl/debug/sockprobe
rustix socketpair: Ok("ok")
$ BLOCK_SOCKETCALL=1 ./target/i686-unknown-linux-musl/debug/sockprobe
rustix socketpair: Err(Os { code: 38, kind: Unsupported, message: "Function not implemented" })

This is hidden on main: the build jobs need min_version, and MinRustV currently fails there because of #15937. The last time i686 ran on main (c21b7adc6, ubuntu-24.04) the tests passed.

GNU tests (SELinux)

The last success ran on ubuntu-24.04 (https://github.com/uutils/coreutils/actions/runs/40602187553), the first failure on ubuntu-26.04 (https://github.com/uutils/coreutils/actions/runs/40605824544). dnf install in the lima VM stops after about 30 packages and the step ends with exit code 255. I don't know why yet.

Pinning these jobs to ubuntu-24.04 might work until the runner image gets Docker 29.4.3.

主要语言
Rust
星标
24.3k
派生
2.1k
平均合并
2 天 5 小时
30 天内合并 PR
387

环境准备

在 Codespaces 中打开

在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

uutils/coreutils 的其他 Issue

查看 uutils/coreutils 的全部 Issue

相似的 Issue

更多 Rust Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。