bug#51073: 28.0.60; SIGSYS in emacs-tests/bwrap/allows-stdout

[Basil L. Contovounesios]

Running 'make test/emacs-tests' fails with status code 159 (where
159 = 128 + 31 and 31 = SIGSYS); see the attached compilation log.

Running 'sudo journalctl -g SECCOMP' includes the following:

  Oct 07 10:48:19 tia audit[2156]: SECCOMP auid=1000 uid=1000 gid=1000
    ses=2 subj==unconfined pid=2156 comm="emacs"
    exe="/home/blc/.local/src/emacs-28/src/emacs" sig=31 arch=c000003e
    syscall=157 compat=0 ip=0x7ff4f975629d code=0x80000000

  Oct 07 10:48:20 tia audit[2171]: SECCOMP auid=1000 uid=1000 gid=1000
    ses=2 subj==unconfined pid=2171 comm="emacs"
    exe="/home/blc/.local/src/emacs-28/src/emacs" sig=31 arch=c000003e
    syscall=257 compat=0 ip=0x7ff14b807823 code=0x80000000

AFAICT syscalls 157 and 257 correspond to prctl and openat,
respectively, and __GI___prctl is mentioned in the attached coredumpctl
stack trace.  This is confirmed by the ausearch ert-info if I run
'sudo make test/emacs-tests' (because ausearch is in my sbin):

  Potentially relevant Seccomp audit events:
  ----
  type=SECCOMP msg=audit(10/07/21 11:25:02.024:209) : auid=blc uid=root
  gid=root ses=3 subj==unconfined pid=5982 comm=emacs
  exe=/home/blc/.local/src/emacs-28/src/emacs sig=SIGSYS arch=x86_64
  syscall=prctl compat=0 ip=0x7fbf2438c29d code=kill

I don't know whether the following caveat from seccomp(2) is relevant
for openat:

  *  Seccomp  filtering is based on system call numbers.  However, appli‐
     cations typically do not directly invoke system calls,  but  instead
     call  wrapper  functions  in  the C library which in turn invoke the
     system calls.  Consequently, one must be aware of the following:
     [...]
     •  Finally,  the  behavior  of  wrapper  functions can change across
        glibc versions.  For example, in older versions, the glibc  wrap‐
        per  function  for  open(2)  invoked  the system call of the same
        name, but starting in glibc 2.26, the implementation switched  to
        calling openat(2) on all architectures.

FWIW here are some of my local versions:

  $ bwrap --version
  bubblewrap 0.5.0
  $ uname -a
  Linux tia 5.14.0-1-amd64 #1 SMP Debian 5.14.6-2 (2021-09-19) x86_64 GNU/Linux
  $ /lib/x86_64-linux-gnu/libc.so.6 
  GNU C Library (Debian GLIBC 2.32-4) stable release version 2.32.
  Copyright (C) 2020 Free Software Foundation, Inc.
  This is free software; see the source for copying conditions.
  There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
  PARTICULAR PURPOSE.
  Compiled by GNU CC version 10.3.0.
  libc ABIs: UNIQUE IFUNC ABSOLUTE
  For bug reporting instructions, please see:
  <http://www.debian.org/Bugs/>.

HTH.  Let me know if you'd like me to test anything.

Thanks,

-- 
Basil

In GNU Emacs 28.0.60 (build 1, x86_64-pc-linux-gnu, X toolkit, cairo version 
1.16.0, Xaw3d scroll bars)
 of 2021-10-07 built on tia
Repository revision: 1100fffcd360867c0116cb5c4d17bab535577c03
Repository branch: emacs-28
Windowing system distributor 'The X.Org Foundation', version 11.0.12011000
System Description: Debian GNU/Linux bookworm/sid

Configured using:
 'configure 'CFLAGS=-O0 -ggdb3' --prefix=/home/blc/.local
 --program-suffix=-28 --enable-checking=yes,glyphs
 --enable-check-lisp-type --with-x-toolkit=lucid
 --with-file-notification=yes --with-x'

Configured features:
ACL CAIRO DBUS FREETYPE GIF GLIB GMP GNUTLS GPM GSETTINGS HARFBUZZ JPEG
JSON LCMS2 LIBOTF LIBSELINUX LIBSYSTEMD LIBXML2 M17N_FLT MODULES NOTIFY
INOTIFY PDUMPER PNG RSVG SECCOMP SOUND THREADS TIFF TOOLKIT_SCROLL_BARS
X11 XAW3D XDBE XIM XPM LUCID ZLIB

Important settings:
  value of $LANG: en_IE.UTF-8
  value of $XMODIFIERS: @im=ibus
  locale-coding-system: utf-8-unix

Major mode: Lisp Interaction

Minor modes in effect:
  tooltip-mode: t
  global-eldoc-mode: t
  eldoc-mode: t
  show-paren-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  line-number-mode: t
  indent-tabs-mode: t
  transient-mark-mode: t

Load-path shadows:
None found.

Features:
(shadow sort mail-extr emacsbug message rmc puny dired dired-loaddefs
rfc822 mml mml-sec epa derived epg rfc6068 epg-config gnus-util rmail
rmail-loaddefs auth-source cl-seq eieio eieio-core cl-macs
eieio-loaddefs password-cache json map text-property-search time-date
subr-x seq byte-opt gv bytecomp byte-compile cconv mm-decode mm-bodies
mm-encode mail-parse rfc2231 mailabbrev gmm-utils mailheader cl-loaddefs
cl-lib sendmail rfc2047 rfc2045 ietf-drums mm-util mail-prsvr mail-utils
iso-transl tooltip eldoc paren electric uniquify ediff-hook vc-hooks
lisp-float-type elisp-mode mwheel term/x-win x-win term/common-win x-dnd
tool-bar dnd fontset image regexp-opt fringe tabulated-list replace
newcomment text-mode lisp-mode prog-mode register page tab-bar menu-bar
rfn-eshadow isearch easymenu timer select scroll-bar mouse jit-lock
font-lock syntax font-core term/tty-colors frame minibuffer cl-generic
cham georgian utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao
korean japanese eucjp-ms cp51932 hebrew greek romanian slovak czech
european ethiopic indian cyrillic chinese composite emoji-zwj charscript
charprop case-table epa-hook jka-cmpr-hook help simple abbrev obarray
cl-preloaded nadvice button loaddefs faces cus-face macroexp files
window text-properties overlay sha1 md5 base64 format env code-pages
mule custom widget hashtable-print-readable backquote threads dbusbind
inotify lcms2 dynamic-setting system-font-setting font-render-setting
cairo x-toolkit x multi-tty make-network-process emacs)

compilation.log
Description: Compilation log