Repository navigation
Conversation
kolyshkin
force-pushed
the
test-latest-old
branch
5 times, most recently
from
July 16, 2026 20:38
a778e40 to
7a23cee
Compare
When built against libseccomp headers older than v2.4.0, this package compiles its own always-fails fallback definitions of seccomp_api_get and seccomp_api_set. Because cgo places the whole preamble into the same translation unit as the code that calls these functions, the call is resolved at compile time: even though the libseccomp shared library actually loaded at runtime may be much newer and fully support these calls, the compiled-in stub always runs instead, so GetAPI() incorrectly reports "API level operations are not supported" (API level 0). Fix this by having the fallback look up the real symbol at runtime via dlsym(RTLD_DEFAULT, ...), only returning the "unsupported" result if that lookup fails. This correctly handles the common case of a binary built against one libseccomp version but run against another, newer one. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Same issue as the previous commit but for seccomp_notify_* functions: when built against libseccomp headers older than v2.5.0, this package compiles its own always-fails fallback definitions of them, which, due to cgo placing the whole preamble into the same translation unit as the calling code, get resolved at compile time regardless of what the runtime libseccomp shared library actually supports. Unlike seccomp_api_get/set, these fallbacks are only reachable via notifSupported(), which already gates every other notify call. So instead of a dlsym()-based runtime lookup, just track at compile time whether the real functions were available (HAVE_NOTIFY) and have notifSupported() report unsupported directly in that case, without ever calling into the fallback stubs. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
This adds a CI step to run tests from the test binary which was built using older libseccomp version against the latest libseccomp version. This should reveal a bug fixed by the previous commit. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
kolyshkin
force-pushed
the
test-latest-old
branch
from
July 17, 2026 00:09
7a23cee to
09c8942
Compare
kolyshkin
changed the title
Contributor
Author
|
This made its way into #129. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This adds a CI step to run tests from the test binary which was built using older libseccomp version against the system bundled version as well as against latest libseccomp.
This reveals a bug fixed in #127, and two more:
When compiled against libseccomp 2.3.1 but used with [dynamically linked] libseccomp 2.4.0+, GetAPI always returns 0. This is being fixed by trying to dlsym the
seccomp_api_getbefore returning EOPNOTSUPP.When compiled against libseccomp < 2.5.0 but used with [dynamically linked] libseccomp 2.5.0+,
notifSupportedchecks the actual libseccomp version, not the one we compiled against, and thus mistakenly tells notification support is available, but the seccomp_notif_* stubs then return EOPNOTSUPP. This is being fixed by adding a compile time guard.