Compare commits
2 Commits
c9
...
danfimov-p
| Author | SHA1 | Date | |
|---|---|---|---|
| 77e965d4ad | |||
| 36b392a4a7 |
@ -1,33 +0,0 @@
|
||||
From 0000000000000000000000000000000000000005 Mon Sep 17 00:00:00 2001
|
||||
From: Aleksandra Kachanova <akachanova@cloudlinux.com>
|
||||
Date: Mon, 15 Jun 2026 12:00:00 +0000
|
||||
Subject: [PATCH] PF-632: re-assert max_user_namespaces before rootbld bwrap
|
||||
|
||||
A concurrent, non-isolated RPM build on the same node can run
|
||||
`sysctl --system` inside its mock chroot (e.g. cloudlinux-linksafe's
|
||||
%posttrans re-applies the el7 base config), which resets the host's
|
||||
user.max_user_namespaces to 0. bwrap then fails to create a user
|
||||
namespace with the misleading "No space left on device". Re-assert the
|
||||
value immediately before invoking bwrap. Best-effort: never fail the
|
||||
build if the re-assert is denied.
|
||||
---
|
||||
abuild.in | 3 +++
|
||||
1 file changed, 3 insertions(+)
|
||||
|
||||
diff --git a/abuild.in b/abuild.in
|
||||
index 4447b4d..5555555 100644
|
||||
--- a/abuild.in
|
||||
+++ b/abuild.in
|
||||
@@ -2636,6 +2636,9 @@ rootbld() {
|
||||
printf("%s\n", users[i]) > (root "/passwd")
|
||||
}'
|
||||
|
||||
+ # PF-632: re-assert user.max_user_namespaces before bwrap (a concurrent RPM build's sysctl --system can reset it to 0).
|
||||
+ sudo -n sysctl -w user.max_user_namespaces=20000 >/dev/null 2>&1 || true
|
||||
+
|
||||
local bwrap_opts=""
|
||||
options_has "net" || bwrap_opts="$bwrap_opts --unshare-net"
|
||||
bwrap --new-session --unshare-ipc --unshare-uts $bwrap_opts \
|
||||
--
|
||||
2.43.5
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
Name: abuild
|
||||
Version: 3.15.0
|
||||
Release: 2%{?dist}
|
||||
Release: 1%{?dist}
|
||||
Summary: Alpine build tools
|
||||
|
||||
License: GPL-2.0-or-later
|
||||
@ -13,7 +13,6 @@ Patch0: 0001-Do-not-build-docs.patch
|
||||
Patch1: 0002-Allow-running-abuild-rootbld.patch
|
||||
Patch2: 0003-Pass-startdir-as-a-bind-mount.patch
|
||||
Patch3: 0004-Backport-b0d3dbe3.patch
|
||||
Patch4: 0005-Reapply-sysctl-before-rootbld.patch
|
||||
|
||||
BuildRequires: zlib-devel
|
||||
BuildRequires: make
|
||||
@ -59,7 +58,6 @@ abuild is a set of scripts used to build Alpine Linux packages.
|
||||
%patch1 -p1
|
||||
%patch2 -p1
|
||||
%patch3 -p1
|
||||
%patch4 -p1
|
||||
|
||||
%build
|
||||
make VERSION=%{version}
|
||||
@ -102,8 +100,5 @@ done
|
||||
%{_tmpfilesdir}/%{name}.conf
|
||||
|
||||
%changelog
|
||||
* Mon Jun 15 2026 Aleksandra Kachanova <akachanova@cloudlinux.com> - 3.15.0-2
|
||||
- Reapply user.max_user_namespaces sysctl before rootbld bwrap (PF-632)
|
||||
|
||||
* Mon Jul 07 2025 Andrew Lukoshko <alukoshko@cloudlinux.com> - 3.15.0-1
|
||||
- Initial RPM release
|
||||
|
||||
Loading…
Reference in New Issue
Block a user