This is not limited to kernels older than 5.6. The same hard failure occurs on
a current kernel whenever openat2 is
unavailable at runtime for any other reason, in particular under CPU emulation.
Observed on: linux/amd64 containers on an Apple Silicon Mac (macOS 26.7),
colima 0.10.3 with vmType vz and rosetta:
true, guest kernel 6.8.0-100-generic, Docker 29.2.1.
Rosetta does not implement openat2, so it returns ENOSYS on a kernel
that supports the syscall natively:
raw syscall openat2(nr=437) = -1 errno=38 (Function not implemented)
glibc openat2() = -1 errno=38 (Function not implemented)
openat() = 7 errno=0 (ok)
That makes every Apple Silicon developer running amd64 containers
affected, not just hosts with old kernels.
PORTABLE REPRODUCER (no old kernel or Mac required, any machine with Docker).
Force openat2 to return ENOSYS with a
seccomp profile:
cat > enosys-openat2.json <<'EOF'
{
"defaultAction": "SCMP_ACT_ALLOW",
"syscalls": [
{ "names": ["openat2"], "action": "SCMP_ACT_ERRNO", "errnoRet": 38 }
]
}
EOF
docker run --rm --security-opt seccomp=enosys-openat2.json ubuntu:26.04 bash
-c '
cd /tmp && mkdir -p d/sub && echo hi > d/sub/f && cd d
echo "-- create:"; tar cf out.tar sub/f
tar cf ok.tar -C . . 2>/dev/null
echo "-- extract:"; mkdir -p x && tar xf ok.tar -C x'
-- create:
tar: sub/f: Cannot stat: Function not implemented
-- extract:
tar: ./sub/f: Cannot open: Function not implemented
Without --security-opt both succeed. With it, downgrading to
tar=1.35+dfsg-4 also makes both succeed.
Only multi-component paths are affected:
tar cf a.tar sub/f -> fails tar cf a.tar -C sub . -> works
extract archive w/ dirs -> fails flat archive extract -> works
CODE POINTER for why the gnulib fallback is gone. gnu/openat2.c does have the
correct runtime fallback ("Keep going, to
support the dubious practice of compiling for an older kernel"), but
m4/openat2.m4 (serial 1) disables the
replacement whenever the C library provides openat2:
AC_CHECK_FUNCS_ONCE([openat2])
AS_CASE([$ac_cv_func_openat2],
[yes], [HAVE_OPENAT2=1])
glibc 2.43 added an openat2() wrapper, so the check succeeds and gnulib's
emulation is compiled out. This will hit any
distribution moving to glibc 2.43, so it likely warrants forwarding upstream.
FURTHER IMPACT: extraction is broken too, so "apt-get source <pkg>" fails on
affected systems (dpkg-source unpacks
with tar). A failed "dpkg-deb -b" also leaves a truncated .deb behind with
valid control metadata, but incomplete
contents.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2166326
Title:
tar hard-fails with ENOSYS on kernels < 5.6 in Ubuntu 26.04
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/tar/+bug/2166326/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
