{"record":{"id":"1ca510103e9d5a70","repo":"podman-container-tools/podman","slug":"cannot-sigdelset-sigterm-m-n","errorCode":null,"errorMessage":"cannot sigdelset(SIGTERM): %m\\n","messagePattern":"cannot sigdelset\\(SIGTERM\\): %m\\\\n","errorType":"console","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/rootless/rootless_linux.c","lineNumber":1349,"sourceCode":"          unsetenv (\"LISTEN_FDS\");\n          unsetenv (\"LISTEN_FDNAMES\");\n        }\n      return pid;\n    }\n\n  if (sigfillset (&sigset) < 0)\n    {\n      fprintf (stderr, \"cannot fill sigset: %m\\n\");\n      _exit (EXIT_FAILURE);\n    }\n  if (sigdelset (&sigset, SIGCHLD) < 0)\n    {\n      fprintf (stderr, \"cannot sigdelset(SIGCHLD): %m\\n\");\n      _exit (EXIT_FAILURE);\n    }\n  if (sigdelset (&sigset, SIGTERM) < 0)\n    {\n      fprintf (stderr, \"cannot sigdelset(SIGTERM): %m\\n\");\n      _exit (EXIT_FAILURE);\n    }\n  if (sigprocmask (SIG_BLOCK, &sigset, &oldsigset) < 0)\n    {\n      fprintf (stderr, \"cannot block signals: %m\\n\");\n      _exit (EXIT_FAILURE);\n    }\n\n  argv = get_cmd_line_args (NULL);\n  if (argv == NULL)\n    {\n      fprintf (stderr, \"cannot read argv: %m\\n\");\n      _exit (EXIT_FAILURE);\n    }\n\n  argv0 = argv[0];\n\n  if (do_socket_activation)","sourceCodeStart":1331,"sourceCodeEnd":1367,"githubUrl":"https://github.com/podman-container-tools/podman/blob/a2409076ef2fef60ad9ac046375dedc7d9410ef4/pkg/rootless/rootless_linux.c#L1331-L1367","documentation":"Printed at pkg/rootless/rootless_linux.c:1349 in reexec_in_user_namespace()'s child branch when sigdelset(&sigset, SIGTERM) fails. The code fills a signal set, deletes SIGCHLD and SIGTERM so those two stay deliverable, then blocks everything else with sigprocmask(SIG_BLOCK). Since sigfillset() succeeded and SIGTERM is a valid constant, a failure here means the sigset_t was corrupted or the libc is broken — it is a defensive, near-unreachable branch that ends with _exit(EXIT_FAILURE).","triggerScenarios":"Rootless podman bootstrap (reexec_in_user_namespace child) where sigdelset of the constant SIGTERM returns -1 after sigfillset and sigdelset(SIGCHLD) both succeeded: memory corruption of the sigset variable or a defective libc.","commonSituations":"Not seen in practice on mainstream systems; only plausible with custom/old libc builds, stack corruption from a third-party patch, or faulty hardware (RAM errors). It aborts the rootless child before the uid/gid map handshake, so the podman command fails at startup.","solutions":["Rebuild from clean sources and test with ASan/valgrind to rule out stack/sigset corruption.","Sanity-check the libc with a standalone sigfillset/sigdelset(SIGTERM) test program; if it fails, fix or replace the libc.","Check for hardware/OOM corruption: run memtest or inspect dmesg for OOM killer activity.","If reproducible on a supported distro, file an upstream containers/podman issue with full environment details."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# minimal environment check before invoking rootless podman\nenv | grep '^LD_PRELOAD=' && echo 'warning: LD_PRELOAD present, unset it for testing'\nldd --version | head -1","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep the toolchain/libc consistent with what the podman binary was built against.","Do not patch rootless_linux.c signal handling without rebuilding the whole binary.","Consider this branch a tripwire: it firing means corruption or bad libc, not a podman misconfiguration."],"tags":["podman","rootless","userns","signals","c","libc"],"backgroundTag":null,"analyzedSha":"a2409076ef2fef60ad9ac046375dedc7d9410ef4","analyzedAt":"2026-08-15T15:57:05.625Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}