Skip to content

utils: Enable mount_setattr when compiling with older glibc - #785

Merged
smcv merged 1 commit into
containers:mainfrom
ao2:enable-mount-setattr-with-older-glibc
Sep 7, 2026
Merged

utils: Enable mount_setattr when compiling with older glibc#785
smcv merged 1 commit into
containers:mainfrom
ao2:enable-mount-setattr-with-older-glibc

Conversation

@ao2

@ao2 ao2 commented Sep 7, 2026

Copy link
Copy Markdown
Contributor

On some systems where bubblewrap is compiled/run it might happen that the kernel is new enough to have the mount_setattr syscall implemented, but the userspace side still needs __NR_mount_setattr explicitly defined to access it, because glibc may lag behind.

Define a fallback definition of __NR_mount_setattr at least for some more common architectures to enable mount_setattr, on such systems.

For instance, this enables the possible usage of mount_setattr with bubblewrap binaries compiled in the Steam Runtime SDK.

On some systems where bubblewrap is compiled/run it might happen that
the kernel is new enough to have the `mount_setattr` syscall
implemented, but the userspace side still needs `__NR_mount_setattr`
explicitly defined to access it, because glibc may lag behind.

Define a fallback definition of `__NR_mount_setattr` at least for some
more common architectures to enable `mount_setattr`, on such systems.

For instance, this enables the possible usage of `mount_setattr` with
bubblewrap binaries compiled in the Steam Runtime SDK.

Signed-off-by: Antonio Ospite <antonio.ospite@collabora.com>
@ao2

ao2 commented Sep 7, 2026

Copy link
Copy Markdown
Contributor Author

cc @smcv

@smcv smcv left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, have you confirmed (using strace) that a bwrap compiled in a sufficiently old container still calls the mount_setattr syscall?

(For example you could compile in https://gitlab.steamos.cloud/steamrt/scout/sdk and run the resulting binary on a modern system)

@ao2

ao2 commented Sep 7, 2026

Copy link
Copy Markdown
Contributor Author

LGTM, have you confirmed (using strace) that a bwrap compiled in a sufficiently old container still calls the mount_setattr syscall?

Good idea, I'll do the strace test with and without this MR and report back.

(For example you could compile in https://gitlab.steamos.cloud/steamrt/scout/sdk and run the resulting binary on a modern system)

BTW it looks like we need the changes from #786 to be able to build in the scout SDK.

@ao2

ao2 commented Sep 7, 2026

Copy link
Copy Markdown
Contributor Author

@smcv I built on scout two binaries, one without the changes in MR, and one with the changes in MR applied, and things seem to work as expected:

$ strace -f ./scout_bwrap_NO_bubblewrap_PR_785 --bind / / true 2>&1 | grep mount_setattr
$ strace -f ./scout_bwrap_bubblewrap_PR_785 --bind / / true 2>&1 | grep mount_setattr
[pid 107883] mount_setattr(7, "", AT_EMPTY_PATH|AT_RECURSIVE, {attr_set=MOUNT_ATTR_NOSUID|MOUNT_ATTR_NODEV, attr_clr=0, propagation=0 /* MS_??? */, userns_fd=0}, 32) = 0

@smcv

smcv commented Sep 7, 2026

Copy link
Copy Markdown
Collaborator

things seem to work as expected

Great, let's apply this then.

@smcv
smcv merged commit 79d096f into containers:main Sep 7, 2026
4 checks passed
@ao2
ao2 deleted the enable-mount-setattr-with-older-glibc branch September 8, 2026 07:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants