[shepherd] 02/02: shepherd: Keep going when reboot(RB_DISABLE_CAD) returns ENOSYS.

[Ludovic Courtès]

civodul pushed a commit to branch main
in repository shepherd.

commit 0d33e711488857bda1bbe25823040d7e1b28f201
Author: Ludovic Courtès <ludo@gnu.org>
AuthorDate: Sun Jan 21 22:51:03 2024 +0100

    shepherd: Keep going when reboot(RB_DISABLE_CAD) returns ENOSYS.
    
    Thanks to @chexum@hachyderm.io for explaining the origin of ENOSYS.
    
    * modules/shepherd.scm (main): Treat ENOSYS from
    ‘disable-reboot-on-ctrl-alt-del’ gracefully.
    * NEWS: Update.
---
 NEWS                 | 6 ++++++
 modules/shepherd.scm | 6 ++++--
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/NEWS b/NEWS
index 1e3f750..ea40b08 100644
--- a/NEWS
+++ b/NEWS
@@ -18,6 +18,12 @@ Please send Shepherd bug reports to bug-guix@gnu.org.
 Previously, since version 0.10.0, ‘herd unload root all’ would unregister all
 services without first stopping them, leaving the system in a bogus state.
 
+** ‘shepherd’ no longer bails out when reboot(2) returns ENOSYS
+
+In runc environments (among others), reboot(RB_DISABLE_CAD) returns ENOSYS,
+which would lead shepherd to fail to start.  This would prevent the use of
+shepherd in some containerized environments such as those of GitLab-CI.
+
 * Changes in 0.10.3
 
 ** Fix a bug that could lead shepherd to hang after loading replacements
diff --git a/modules/shepherd.scm b/modules/shepherd.scm
index 9e980c4..6d5adf6 100644
--- a/modules/shepherd.scm
+++ b/modules/shepherd.scm
@@ -1,5 +1,5 @@
 ;; shepherd.scm -- The daemon shepherd.
-;; Copyright (C) 2013-2014, 2016, 2018-2020, 2022-2023 Ludovic Courtès 
<ludo@gnu.org>
+;; Copyright (C) 2013-2014, 2016, 2018-2020, 2022-2024 Ludovic Courtès 
<ludo@gnu.org>
 ;; Copyright (C) 2002, 2003 Wolfgang Jährling <wolfgang@pro-linux.de>
 ;; Copyright (C) 2018 Carlo Zancanaro <carlo@zancanaro.id.au>
 ;; Copyright (C) 2018 Danny Milosavljevic <dannym@scratchpost.org>
@@ -479,7 +479,9 @@ fork in the child process."
                 ;; When in a separate PID namespace, we get EINVAL (see
                 ;; 'reboot_pid_ns' in kernel/pid_namespace.c.)  We get EPERM in
                 ;; a user namespace that lacks CAP_SYS_BOOT.
-                (unless (member err (list EINVAL EPERM))
+                ;; ENOSYS is returned in runc environments due to seccomp
+                ;; defaults: 
<https://github.com/opencontainers/runc/pull/2750>.
+                (unless (member err (list EINVAL EPERM ENOSYS))
                   (apply throw args)))))
 
           ;; Load the SIGSEGV/SIGABRT handler.  This is what allows PID 1 to