{"record":{"id":"051eec2d0fbc64d5","repo":"podman-container-tools/podman","slug":"cannot-prctl-pr-set-pdeathsig-m","errorCode":null,"errorMessage":"cannot prctl(PR_SET_PDEATHSIG): %m\n","messagePattern":"cannot prctl\\(PR_SET_PDEATHSIG\\): %m\n","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/rootless/rootless_linux.c","lineNumber":1210,"sourceCode":"\n  if (do_socket_activation)\n    {\n      char s[32];\n      sprintf (s, \"%d\", getpid());\n      setenv (\"LISTEN_PID\", s, true);\n      setenv (\"LISTEN_FDS\", saved_systemd_listen_fds, true);\n      // Setting fdnames is optional for systemd_socket_activation\n      if (saved_systemd_listen_fdnames != NULL)\n        setenv (\"LISTEN_FDNAMES\", saved_systemd_listen_fdnames, true);\n    }\n\n  setenv (\"_CONTAINERS_USERNS_CONFIGURED\", \"done\", 1);\n  setenv (\"_CONTAINERS_ROOTLESS_UID\", uid, 1);\n  setenv (\"_CONTAINERS_ROOTLESS_GID\", gid, 1);\n\n  if (prctl (PR_SET_PDEATHSIG, SIGTERM, 0, 0, 0) < 0)\n    {\n      fprintf (stderr, \"cannot prctl(PR_SET_PDEATHSIG): %m\\n\");\n      _exit (EXIT_FAILURE);\n    }\n\n  join_namespace_or_die (\"user\", userns_fd);\n  join_namespace_or_die (\"mnt\", mntns_fd);\n\n  if (syscall_setresgid (0, 0, 0) < 0)\n    {\n      fprintf (stderr, \"cannot setresgid: %m\\n\");\n      _exit (EXIT_FAILURE);\n    }\n\n  if (syscall_setresuid (0, 0, 0) < 0)\n    {\n      fprintf (stderr, \"cannot setresuid: %m\\n\");\n      _exit (EXIT_FAILURE);\n    }\n","sourceCodeStart":1192,"sourceCodeEnd":1228,"githubUrl":"https://github.com/podman-container-tools/podman/blob/a2409076ef2fef60ad9ac046375dedc7d9410ef4/pkg/rootless/rootless_linux.c#L1192-L1228","documentation":"In the reexec_userns_join child, prctl(PR_SET_PDEATHSIG, SIGTERM, 0, 0, 0) failed and the child _exit(EXIT_FAILURE)s before joining the target namespaces. PDEATHSIG makes the joiner die with its parent so no orphan holds the namespace. On Linux this prctl fails with EINVAL only for a bad signal — so a real-world failure almost always means a seccomp filter or LSM denied prctl (EPERM).","triggerScenarios":"Running the rootless join path under a seccomp profile that blocks or errors prctl (restricted containers, custom sandboxes, some CI runners); LSM/AppArmor confinement denying prctl for the process.","commonSituations":"Podman nested inside a hardened container or agent sandbox whose default seccomp profile denies prctl; corporate endpoint-security LSMs injecting policy.","solutions":["Allow prctl(PR_SET_PDEATHSIG) in the governing seccomp profile / sandbox policy","Run the join outside the restricting sandbox (e.g. on the host) to confirm the diagnosis","File a policy exception with the sandbox/agent maintainer — podman requires this prctl for rootless joins"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# verify prctl is allowed by the sandbox's seccomp policy\nstrace -e prctl -f unshare --user --map-root-user true 2>&1 | grep -i prctl || echo \"prctl not observed/allowed?\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Allow prctl(PR_SET_PDEATHSIG) in any seccomp/LKM policy governing podman processes","Whitelist the podman binary in endpoint-security/AppArmor policies that deny prctl","Smoke-test rootless podman (podman info) inside new sandbox images before adopting them"],"tags":["podman","rootless","prctl","seccomp","sandbox"],"backgroundTag":null,"analyzedSha":"a2409076ef2fef60ad9ac046375dedc7d9410ef4","analyzedAt":"2026-08-15T15:57:05.625Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}