Bug#1108092: sbuild: [unshare] E: Sub-process cat >&11 returned an error code (2)

[Jochen Sprickerhof]

* picca <pi...@debian.org> [2025-06-23 14:27]:

The problem is that make-all leaks file descriptors:

$ ls -l /proc/423642/fd/
lr-x------ 1 jspricke jspricke 64 23. Jun 13:30 0 -> 'pipe:[412637]'
l-wx------ 1 jspricke jspricke 64 23. Jun 13:30 1 -> 'pipe:[418570]'
l-wx------ 1 jspricke jspricke 64 23. Jun 13:30 2 -> 'pipe:[418556]'

lr-x------ 1 jspricke jspricke 64 23. Jun 13:30 3 -> /usr/bin/mmdebstrap lrwx------ 1 jspricke jspricke 64 23. Jun 13:30 4 -> /home/jspricke/pkg-haskell-tools/lab/.shake/.shake.lock lrwx------ 1 jspricke jspricke 64 23. Jun 13:30 5 -> /home/jspricke/pkg-haskell-tools/lab/.shake/.shake.database lr-x------ 1 jspricke jspricke 64 23. Jun 13:30 6 -> /home/jspricke/pkg-haskell-tools/lab/cache/binaries/ufo-core.txt

Which  one is the one leaking ?

4, 5 and 6 are leaking.

I guess you want to set close_fds here:

https://hackage.haskell.org/package/process-1.0.1.1/docs/System-Process.html#t%3ACreateProcess

I can confirm that adding

                     Exit c ← cmdWrap "sbuild" $ cmd
                            (Cwd targetDir)
                            (EchoStdout False)
+                             (CloseFileHandles) $
                            ["sbuild"
                            --, "-c", schrootName
                            --, "-c", "unstable-amd64"
                            , "-A"
                            , "--no-apt-update"
                            , "--dist", dist

--, "--chroot-setup-commands=bash " ++ cfixup , "--extra-repository=deb http://deb.debian.org/debian unstable main contrib non-free non-free-firmware" , "--extra-repository=deb [trusted=yes] file://" ++ crepoDir ++ " ./"

                            , dsc
                            ] ++ sbuildArgs

make it works...

Great.

Now my question why is it necessary ?

Because mmdebstrap assumes that it is not called with unrelated open file descriptors.

$unshare_bind_mounts = [ { directory => "/dev/shm", mountpoint => "/sharedshm" } ];

Can you give some reasoning why you want to do that?

fixupScript ∷ [String] → String
fixupScript pkgs = unlines $
   [ "#!/bin/bash"

   -- via /etc/schroot/default/fstab, so with locking, I could not run
   -- multiple sbuilds at the same time

   ] ++ ignoreArchiveDepends pkgs

ignoreArchiveDepends ∷ [String] → [String]
ignoreArchiveDepends [] = []
ignoreArchiveDepends pkgs =
   [ "#!/bin/bash"

   , "for f in /var/lib/apt/lists/*_Packages"
   , "do"

   , "mv \"$f\".tmp \"$f\""
   , "done"
   ]
 where disj = intercalate " -o " pkgs

the current code of dht (with the schroot) create a fix script 'cfixup' on the host and a repository. -- I disable locking in the schroot. I have /var/cache/apt/archives bind-mounted , "echo 'Debug::NoLocking \"true\";' > /etc/apt/apt.conf.d/no-locking" , "apt-get install dctrl-tools" -- Just in case it is not installed in the base schroot , "grep-dctrl -v -F Package -X \\( " ++ disj ++ " \\) < \"$f\" > \"$f\".tmp"

Cheers Jochen

Oof, I am not sure I fully understand what is going on here but I would recommend to do it differently. Are you aware that you can pass a directory to sbuild --extra-package and sbuild will create a repository on the fly? I use it together with sbuild --build-dir to do bigger rebuilds. I assume make-all is trying to do something similar, so maybe those commands could be used instead?

signature.asc
Description: PGP signature