Update busybox:glibc in integration tests to latest builds

[tianon]

• runc no_pivot test fails on ppc64le #4836 (comment)

The repo structure changed a little, but it was trivial enough to adapt to (given I knew exactly where to point the hammer 😂 ❤️). 👍

@kolyshkin want to give this a try? I know you said 1.35.1, but I went all the way to 1.37.0 because it's worth trying latest instead first, right? (Worst case I update and walk it back again 😅)

[kolyshkin]

nit: this comment is now outdated.

[tianon]

Oops, good catch! Updated with a link to the commit history of the library/busybox file so it's hopefully more clear where the commit hash comes from. 👍

[kolyshkin]

@ricardobranco777 can you test if this fixes #4836 for you?

[ricardobranco777]

@ricardobranco777 can you test if this fixes #4836 for you?

Sure, thanks!

[ricardobranco777]

@ricardobranco777 can you test if this fixes #4836 for you?

It works for other architectures but continues failing on ppc64le: https://openqa.opensuse.org/tests/5228054

The coredump is available at https://openqa.opensuse.org/tests/5228054/file/runc-unshare.44911.core.gz

I notice other coredumps for mkdir in https://openqa.opensuse.org/tests/5228054#downloads

[ricardobranco777]

I notice other coredumps for mkdir in https://openqa.opensuse.org/tests/5228054#downloads

https://openqa.opensuse.org/tests/5228054/file/runc-coredumpctl.txt

Weird that mkdir was killed with SIGSYS but this is not exclusive to ppc64le.

TIME                          PID  UID  GID SIG     COREFILE EXE            SIZE
Thu 2025-08-07 14:28:11 EDT 16817 1000 1000 SIGSYS  present  /bin/mkdir   203.8K
Thu 2025-08-07 14:28:12 EDT 16903 1000 1000 SIGSYS  present  /bin/mkdir   203.7K
Thu 2025-08-07 14:31:36 EDT 44911    0    0 SIGSEGV present  /bin/unshare 204.2K
Thu 2025-08-07 14:32:02 EDT 49319    0    0 SIGSYS  present  /bin/mkdir   203.8K
Thu 2025-08-07 14:32:03 EDT 49405    0    0 SIGSYS  present  /bin/mkdir   203.8K

The mkdir part is not exclusive to ppc64le but also seen on x86_64:
https://openqa.suse.de/tests/18719598/logfile?filename=runc-coredumpctl.txt

[kolyshkin]

I notice other coredumps for mkdir in https://openqa.opensuse.org/tests/5228054#downloads
The mkdir part is not exclusive to ppc64le but also seen on x86_64: https://openqa.suse.de/tests/18719598/logfile?filename=runc-coredumpctl.txt

Again, this is part of test. We check that seccomp we specify in spec is properly applied, and use mkdir. Here's the test:

runc/tests/integration/seccomp.bats

Lines 155 to 166 in 89c46a9

	@test "runc run [seccomp] (SCMP_ACT_KILL)" {
	update_config ' .process.args = ["/bin/sh", "-c", "mkdir /dev/shm/foo"]
	| .process.noNewPrivileges = false
	| .linux.seccomp = {
	"defaultAction":"SCMP_ACT_ALLOW",
	"architectures":["SCMP_ARCH_X86","SCMP_ARCH_X32","SCMP_ARCH_X86_64","SCMP_ARCH_AARCH64","SCMP_ARCH_ARM"],
	"syscalls":[{"names":["mkdir","mkdirat"], "action":"SCMP_ACT_KILL"}]
	}'
	runc run test_busybox
	[ "$status" -ne 0 ]
	}

[kolyshkin]

I notice other coredumps for mkdir in https://openqa.opensuse.org/tests/5228054#downloads
The mkdir part is not exclusive to ppc64le but also seen on x86_64: https://openqa.suse.de/tests/18719598/logfile?filename=runc-coredumpctl.txt

Again, this is part of test. We check that seccomp we specify in spec is properly applied, and use mkdir. Here's the test:

runc/tests/integration/seccomp.bats

Lines 155 to 166 in 89c46a9

	@test "runc run [seccomp] (SCMP_ACT_KILL)" {
	update_config ' .process.args = ["/bin/sh", "-c", "mkdir /dev/shm/foo"]
	| .process.noNewPrivileges = false
	| .linux.seccomp = {
	"defaultAction":"SCMP_ACT_ALLOW",
	"architectures":["SCMP_ARCH_X86","SCMP_ARCH_X32","SCMP_ARCH_X86_64","SCMP_ARCH_AARCH64","SCMP_ARCH_ARM"],
	"syscalls":[{"names":["mkdir","mkdirat"], "action":"SCMP_ACT_KILL"}]
	}'
	runc run test_busybox
	[ "$status" -ne 0 ]
	}

In this case, seccomp acts as if the program got SIGSYS.

[ricardobranco777]

In this case, seccomp acts as if the program got SIGSYS.

Of course. Now it makes sense! Thanks.

[kolyshkin]

@ricardobranco777 I see no other way as to build busybox's unshare with debug info on and run it in your environment, instead of a bundled unshare binary from the bb image.

[ricardobranco777]

@ricardobranco777 I see no other way as to build busybox's unshare with debug info on and run it in your environment, instead of a bundled unshare binary from the bb image.

Thanks for the suggestion. I'll try this on Monday.

[tianon]

I've hacked up a build of this with busybox_unstripped so that it hopefully contains debug symbols (and thus will hopefully generate a more useful/helpful core dump):

Suggested change

	url="https://github.com/docker-library/busybox/raw/3bbb15b7efd6d99a73690516b4499b6642f97ef5/latest/glibc/ppc64le/rootfs.tar.gz"
	url="https://github.com/docker-library/busybox/raw/83c2287084a6f001a67d97fdfa23497c75520f2a/latest/glibc/ppc64le/rootfs.tar.gz"

docker-library/busybox@83c2287

[tianon]

I can also commit this with a DNM: commit to this PR if you need me to in order to feed it into your OpenQA system; just let me know 👍

[ricardobranco777]

I can also commit this with a DNM: commit to this PR if you need me to in order to feed it into your OpenQA system; just let me know 👍

Cool, let's try this.

[tianon]

Ok, PR updated (temporarily) with a new commit that switches ppc64le specifically to my hacked busybox_unstripped build which should hopefully still have debugging symbols, if I've done everything correctly.

[ricardobranco777]

Ok, PR updated (temporarily) with a new commit that switches ppc64le specifically to my hacked busybox_unstripped build which should hopefully still have debugging symbols, if I've done everything correctly.

Here is the generated core: https://openqa.opensuse.org/tests/5231369/file/runc-core.unshare.45076.core.xz

Unfortunately, the glibc libraries are stripped on the rootfs.

Thanks!

[kolyshkin]

Here is the generated core: https://openqa.opensuse.org/tests/5231369/file/runc-core.unshare.45076.core.xz

With this, I got:

(gdb) bt
#0  0x8a286245445664b0 in ?? ()
#1  0x000000012a4a51f0 in safe_waitpid ()

I'm puzzled as to why unshare calls waitpid.