* [LTP] [PATCH 1/1] CI: Reenable Tumbleweed
@ 2021-10-27 9:20 Petr Vorel
2021-10-27 9:42 ` Petr Vorel
0 siblings, 1 reply; 6+ messages in thread
From: Petr Vorel @ 2021-10-27 9:20 UTC (permalink / raw)
To: ltp
50b3bae29 had to disable Tumbleweed due glibc-2.34 using new syscall
clone3 which is not enabled in Docker seccomp filter [1].
Workaround is to disable Docker seccomp filtering, as we don't need this
protection. This should help to avoid seccomp filtering in the future
for all distros.
[1] https://bugzilla.opensuse.org/show_bug.cgi?id=1190670
Fixes: https://github.com/actions/virtual-environments/issues/4193
Signed-off-by: Petr Vorel <pvorel@suse.cz>
---
Tested:
https://github.com/pevik/iputils/runs/4020083152?check_suite_focus=true
.github/workflows/ci.yml | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3ffde8c48..55d8f5eb5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -76,6 +76,11 @@ jobs:
CC: clang
METADATA: asciidoc-pdf
+ - container: "opensuse/tumbleweed"
+ env:
+ CC: gcc
+ METADATA: asciidoctor
+
- container: "opensuse/leap"
env:
CC: gcc
@@ -110,6 +115,7 @@ jobs:
container:
image: ${{ matrix.container }}
env: ${{ matrix.env }}
+ options: --security-opt seccomp=unconfined
steps:
- name: Show OS
--
2.33.1
--
Mailing list info: https://lists.linux.it/listinfo/ltp
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [LTP] [PATCH 1/1] CI: Reenable Tumbleweed
2021-10-27 9:20 [LTP] [PATCH 1/1] CI: Reenable Tumbleweed Petr Vorel
@ 2021-10-27 9:42 ` Petr Vorel
2021-10-27 9:52 ` Cyril Hrubis
0 siblings, 1 reply; 6+ messages in thread
From: Petr Vorel @ 2021-10-27 9:42 UTC (permalink / raw)
To: ltp
Hi,
<snip>
> container:
> image: ${{ matrix.container }}
> env: ${{ matrix.env }}
> + options: --security-opt seccomp=unconfined
Alternatively 'options: --privileged' could be used (to run privileged
container), IMHO does not matter which of these we take.
Kind regards,
Petr
--
Mailing list info: https://lists.linux.it/listinfo/ltp
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [LTP] [PATCH 1/1] CI: Reenable Tumbleweed
2021-10-27 9:42 ` Petr Vorel
@ 2021-10-27 9:52 ` Cyril Hrubis
2021-10-27 10:13 ` Petr Vorel
0 siblings, 1 reply; 6+ messages in thread
From: Cyril Hrubis @ 2021-10-27 9:52 UTC (permalink / raw)
To: Petr Vorel; +Cc: ltp
Hi!
> > container:
> > image: ${{ matrix.container }}
> > env: ${{ matrix.env }}
> > + options: --security-opt seccomp=unconfined
> Alternatively 'options: --privileged' could be used (to run privileged
> container), IMHO does not matter which of these we take.
Looking at docker documentation it looks like --privileged disables much
more than just the seccomp filtering. I do not think that this is a good
idea. Let's go with just disabling seccomp for affected distros.
--
Cyril Hrubis
chrubis@suse.cz
--
Mailing list info: https://lists.linux.it/listinfo/ltp
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [LTP] [PATCH 1/1] CI: Reenable Tumbleweed
2021-10-27 9:52 ` Cyril Hrubis
@ 2021-10-27 10:13 ` Petr Vorel
2021-10-29 8:22 ` Cyril Hrubis
0 siblings, 1 reply; 6+ messages in thread
From: Petr Vorel @ 2021-10-27 10:13 UTC (permalink / raw)
To: Cyril Hrubis; +Cc: ltp
> Hi!
> > > container:
> > > image: ${{ matrix.container }}
> > > env: ${{ matrix.env }}
> > > + options: --security-opt seccomp=unconfined
> > Alternatively 'options: --privileged' could be used (to run privileged
> > container), IMHO does not matter which of these we take.
> Looking at docker documentation it looks like --privileged disables much
> more than just the seccomp filtering. I do not think that this is a good
> idea. Let's go with just disabling seccomp for affected distros.
IMHO both are ok for just compilation (other projects use it as well for just
CI doing compilation), but sure, let's use the minimum.
FYI this disables seccomp for all machines. Is that ok for you?
IMHO that's not a big deal + we will not have to bother when Fedora also gets
new enough glibc (IMHO problem will periodically occurs on bleeding edge distros
when glibc starts to use new enough syscall).
Kind regards,
Petr
--
Mailing list info: https://lists.linux.it/listinfo/ltp
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [LTP] [PATCH 1/1] CI: Reenable Tumbleweed
2021-10-27 10:13 ` Petr Vorel
@ 2021-10-29 8:22 ` Cyril Hrubis
2021-10-29 9:38 ` Petr Vorel
0 siblings, 1 reply; 6+ messages in thread
From: Cyril Hrubis @ 2021-10-29 8:22 UTC (permalink / raw)
To: Petr Vorel; +Cc: ltp
Hi!
> > Looking at docker documentation it looks like --privileged disables much
> > more than just the seccomp filtering. I do not think that this is a good
> > idea. Let's go with just disabling seccomp for affected distros.
> IMHO both are ok for just compilation (other projects use it as well for just
> CI doing compilation), but sure, let's use the minimum.
> FYI this disables seccomp for all machines. Is that ok for you?
> IMHO that's not a big deal + we will not have to bother when Fedora also gets
> new enough glibc (IMHO problem will periodically occurs on bleeding edge distros
> when glibc starts to use new enough syscall).
Anyways:
Acked-by: Cyril Hrubis <chrubis@suse.cz>
For the original patch that disables seccomp.
--
Cyril Hrubis
chrubis@suse.cz
--
Mailing list info: https://lists.linux.it/listinfo/ltp
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [LTP] [PATCH 1/1] CI: Reenable Tumbleweed
2021-10-29 8:22 ` Cyril Hrubis
@ 2021-10-29 9:38 ` Petr Vorel
0 siblings, 0 replies; 6+ messages in thread
From: Petr Vorel @ 2021-10-29 9:38 UTC (permalink / raw)
To: Cyril Hrubis; +Cc: ltp
Hi Cyril,
> Hi!
> > > Looking at docker documentation it looks like --privileged disables much
> > > more than just the seccomp filtering. I do not think that this is a good
> > > idea. Let's go with just disabling seccomp for affected distros.
> > IMHO both are ok for just compilation (other projects use it as well for just
> > CI doing compilation), but sure, let's use the minimum.
> > FYI this disables seccomp for all machines. Is that ok for you?
> > IMHO that's not a big deal + we will not have to bother when Fedora also gets
> > new enough glibc (IMHO problem will periodically occurs on bleeding edge distros
> > when glibc starts to use new enough syscall).
> Anyways:
> Acked-by: Cyril Hrubis <chrubis@suse.cz>
> For the original patch that disables seccomp.
Thanks, pushed!
Kind regards,
Petr
--
Mailing list info: https://lists.linux.it/listinfo/ltp
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2021-10-29 9:39 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-10-27 9:20 [LTP] [PATCH 1/1] CI: Reenable Tumbleweed Petr Vorel
2021-10-27 9:42 ` Petr Vorel
2021-10-27 9:52 ` Cyril Hrubis
2021-10-27 10:13 ` Petr Vorel
2021-10-29 8:22 ` Cyril Hrubis
2021-10-29 9:38 ` Petr Vorel
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox