CI: ubuntu-26.04 runners break the i686 and SELinux jobs #15955

I couldn't find an existing issue for this, so I'm opening one.

ubuntu-latest jobs now sometimes run on ubuntu-26.04 instead of ubuntu-24.04 (kernel 7.0, Docker 29.4.2 instead of kernel 6.17, Docker 28.0.4). Some jobs fail only on the new image.

i686 (cross)

Docker 29.4.2's default seccomp profile returns ERRNO 38 (ENOSYS) for socketcall. This is moby/moby#52506, fixed in Docker 29.4.3, but the ubuntu-26.04 image still pins 29.4.2: actions/runner-images#14790.

• rustix on x86 does socketpair through socketcall, so test_tr::test_stdin_is_socket fails with os error 38 (musl job).
• test_localization_and_colors fails to spawn the utility with os error 38 (gnu job). i386 glibc also uses socketcall (see Ubuntu 26.04: Docker 29.4.2 blocks socketcall, so i386 containers have no network actions/runner-images#14790), so I think it is the same cause.

Example: https://github.com/uutils/coreutils/actions/runs/40689561866/job/122823471942 (gnu) and https://github.com/uutils/coreutils/actions/runs/40689561866/job/122823472059 (musl), from #15953.

I reproduced the tr failure locally: with a seccomp filter that only returns ENOSYS for socketcall, rustix socketpair on i686-unknown-linux-musl fails with os error 38, and works without the filter.

[package]
name = "sockprobe"
version = "0.1.0"
edition = "2021"

[dependencies]
rustix = { version = "=1.1.5", features = ["net"] }
libc = "0.2"

use rustix::net::{socketpair, AddressFamily, SocketFlags, SocketType};

// Like Docker 29.4.2: socketcall -> ERRNO 38 (ENOSYS), everything else allowed
fn block_socketcall() {
    const SYS_SOCKETCALL_I386: u32 = 102;
    let mut prog = [
        libc::sock_filter { code: (libc::BPF_LD | libc::BPF_W | libc::BPF_ABS) as u16, jt: 0, jf: 0, k: 0 },
        libc::sock_filter { code: (libc::BPF_JMP | libc::BPF_JEQ | libc::BPF_K) as u16, jt: 0, jf: 1, k: SYS_SOCKETCALL_I386 },
        libc::sock_filter { code: (libc::BPF_RET | libc::BPF_K) as u16, jt: 0, jf: 0, k: libc::SECCOMP_RET_ERRNO | libc::ENOSYS as u32 },
        libc::sock_filter { code: (libc::BPF_RET | libc::BPF_K) as u16, jt: 0, jf: 0, k: libc::SECCOMP_RET_ALLOW },
    ];
    let fprog = libc::sock_fprog { len: prog.len() as u16, filter: prog.as_mut_ptr() };
    unsafe {
        assert_eq!(libc::prctl(libc::PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0), 0);
        assert_eq!(libc::prctl(libc::PR_SET_SECCOMP, libc::SECCOMP_MODE_FILTER, &fprog as *const _), 0);
    }
}

fn main() {
    if std::env::var_os("BLOCK_SOCKETCALL").is_some() {
        block_socketcall();
    }
    // rustix on x86 goes through socketcall(SYS_SOCKETPAIR)
    let r = socketpair(AddressFamily::UNIX, SocketType::STREAM, SocketFlags::empty(), None);
    println!("rustix socketpair: {:?}", r.map(|_| "ok"));
}

$ cargo build --target i686-unknown-linux-musl
$ ./target/i686-unknown-linux-musl/debug/sockprobe
rustix socketpair: Ok("ok")
$ BLOCK_SOCKETCALL=1 ./target/i686-unknown-linux-musl/debug/sockprobe
rustix socketpair: Err(Os { code: 38, kind: Unsupported, message: "Function not implemented" })

This is hidden on main: the build jobs need min_version, and MinRustV currently fails there because of #15937. The last time i686 ran on main (c21b7ad, ubuntu-24.04) the tests passed.

GNU tests (SELinux)

The last success ran on ubuntu-24.04 (https://github.com/uutils/coreutils/actions/runs/40602187553), the first failure on ubuntu-26.04 (https://github.com/uutils/coreutils/actions/runs/40605824544). dnf install in the lima VM stops after about 30 packages and the step ends with exit code 255. I don't know why yet.

Pinning these jobs to ubuntu-24.04 might work until the runner image gets Docker 29.4.3.