Kir Kolyshkin 8a3685e621 libct/configs/validate: reject seccomp errnoRet for unsupported actions ...

The runtime spec says about both defaultErrnoRet and errnoRet:

> When the action doesn't support an errno, the runtime MUST print and
> error and fail.

Yet runc silently ignores errnoRet set for any action other than
SCMP_ACT_ERRNO and SCMP_ACT_TRACE.

Add a check to the config validator, so the error is reported early
(before the container init is started) and clearly (including the
syscall name in case of errnoRet).

Since the validator checks all syscall rules, this also covers ones
which are later skipped as redundant (i.e. having the same action as
the default).

Add unit and integration tests, and a CHANGELOG entry.

Reported in issue 5550.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

2026-10-27 23:03:30 -07:00

..

cmd

libcontainer: set close-on-exec on all fds we open

2026-10-25 22:25:58 -07:00

dce-canary

Makefile: add verify-dce target, use it in CI

2026-10-03 03:20:56 -07:00

fuzzing

tests/fuzzing: remove user fuzzer package path

2026-08-28 14:20:16 +08:00

integration

libct/configs/validate: reject seccomp errnoRet for unsupported actions

2026-10-27 23:03:30 -07:00

podman

ci: add podman tests

2026-10-02 16:59:33 -07:00

rootless.sh

tests/int: run bats with --print-output-on-failure

2026-10-02 14:47:36 -07:00