CI: update Ubuntu (26.04) - #637
Merged
Merged
Conversation
AkihiroSuda
force-pushed
the
ubuntu-26.04
branch
from
September 8, 2026 23:14
c0f4a48 to
c716b34
Compare
systemd v258 introduced $LISTEN_PIDFDID, which is set along with $LISTEN_PID
so as to protect the file descriptor passing against PID reuse.
sd_listen_fds(3) ignores the passed file descriptors when $LISTEN_PIDFDID does
not correspond to the calling process.
The activation helper was rewriting $LISTEN_PID to its own PID but leaving
$LISTEN_PIDFDID pointing to the original process, so the target command
received no file descriptor at all:
$ systemd-socket-activate -l /tmp/uuidd.sock \
rootlesskit uuidd --no-pid --no-fork --socket-activation
uuidd: no file descriptors received, check systemctl status uuidd.socket
Rewrite $LISTEN_PIDFDID together with $LISTEN_PID. When the pidfd inode ID
cannot be determined (needs Linux 6.9 or later), just unset the variable so
that the target command falls back to checking $LISTEN_PID only.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
AkihiroSuda
force-pushed
the
ubuntu-26.04
branch
from
September 8, 2026 23:39
c716b34 to
310e495
Compare
Ubuntu 25.10 and later ship an AppArmor profile for /usr/bin/nslookup
(bind9-dnsutils). The profile includes abstractions/nameservice-strict, which
allows reading /etc/resolv.conf and the well-known resolv.conf paths under /run,
but nothing else.
With --detach-netns, RootlessKit does not bind-mount its own resolv.conf to
/etc/resolv.conf, as the child command runs in the host's network namespace and
has to keep following the DNS configuration of the host. So /etc/resolv.conf is
left as the copy-up symlink, and --copy-up=/run redirects its target
/run/systemd/resolve/stub-resolv.conf to /run/.roXXXXXXXXXX/systemd/resolve/
stub-resolv.conf, which the profile does not allow:
$ rootlesskit --net=slirp4netns --copy-up=/etc --copy-up=/run \
--detach-netns -- nslookup example.com
nslookup: parse of /etc/resolv.conf failed
openat(AT_FDCWD, "/etc/resolv.conf", O_RDONLY) = -1 EACCES
Use busybox's nslookup applet for --detach-netns, as busybox is not confined by
AppArmor (its profile is flags=(unconfined)). The non-detached tests keep using
bind9's nslookup, so that they still cover the AppArmor compatibility of the
bind-mounted /etc/resolv.conf.
Also document the caveat in docs/network.md.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
AkihiroSuda
force-pushed
the
ubuntu-26.04
branch
from
September 9, 2026 00:25
310e495 to
44f2cfd
Compare
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
AkihiroSuda
force-pushed
the
ubuntu-26.04
branch
from
September 9, 2026 00:41
44f2cfd to
f758760
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.