6af681dfac
Newer tar started using openat2() via open_subdir() to address CVE-2025-45582 [0]. Now, gnulib, that tar uses, provides the openat2() syscall in two ways [1]: 1) If glibc doesn't provide openat2(), it provides its own version in openat2.c, that tries to call openat2() syscall first, and if it returns ENOSYS, it emulates the function in userspace. 2) If glibc provides openat2(), it uses that directly, without providing any fallback on ENOSYS. Quite recently our test suite started calling nspawn with --suppress-sync=yes. This means that we call seccomp_suppress_sync(), which eventually calls block_open_flag(), that blocks the openat2() syscall completely and refuses it with ENOSYS as this syscall can't be sensibly filtered (see the openat2()-relevant comments in block_open_flag() and seccomp_restrict_sxid()). And when glibc provides openat2(), there's no fallback, so the ENOSYS bubbles up to the user as: TEST-25-IMPORT.sh[163]: + tar xzf /var/tmp/scratch.tar.gz TEST-25-IMPORT.sh[163]: tar: ./adirectory/athirdfile: Cannot open: Function not implemented TEST-25-IMPORT.sh[163]: tar: Exiting with failure status due to previous errors Let's mitigate this by re-enabling sync for TEST-25-IMPORT, at least for now. [0] https://cgit.git.savannah.gnu.org/cgit/tar.git/commit/?id=75b03fdff48916bd0654677ed21379bdb0db016d [1] https://cgit.git.savannah.gnu.org/cgit/gnulib.git/commit/?id=0b97ffdf32bdab909d02449043447237273df75e (cherry picked from commitc955e24916) (cherry picked from commit89512d0606)
System and Service Manager
Details
Most documentation is available on systemd's web site.
Assorted, older, general information about systemd can be found in the systemd Wiki.
Information about build requirements is provided in the README file.
Consult our NEWS file for information about what's new in the most recent systemd versions.
Please see the Code Map for information about this repository's layout and content.
Please see the Hacking guide for information on how to hack on systemd and test your modifications.
Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.
When preparing patches for systemd, please follow our Coding Style Guidelines.
If you are looking for support, please contact our mailing list, join our IRC channel #systemd on libera.chat or Matrix channel
Stable branches with backported patches are available in the stable repo.
We have a security bug bounty program sponsored by the Sovereign Tech Fund hosted on YesWeHack
Repositories with distribution packages built from git main are available on OBS, and also repositories with packages built from the latest stable release