{"record":{"id":"2e0b59bb6e4da6f4","repo":"podman-container-tools/podman","slug":"cannot-block-signals-m","errorCode":null,"errorMessage":"cannot block signals: %m\n","messagePattern":"cannot block signals: %m\n","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/rootless/rootless_linux.c","lineNumber":1189,"sourceCode":"\n  if (sigfillset (&sigset) < 0)\n    {\n      fprintf (stderr, \"cannot fill sigset: %m\\n\");\n      _exit (EXIT_FAILURE);\n    }\n  if (sigdelset (&sigset, SIGCHLD) < 0)\n    {\n      fprintf (stderr, \"cannot sigdelset(SIGCHLD): %m\\n\");\n      _exit (EXIT_FAILURE);\n    }\n  if (sigdelset (&sigset, SIGTERM) < 0)\n    {\n      fprintf (stderr, \"cannot sigdelset(SIGTERM): %m\\n\");\n      _exit (EXIT_FAILURE);\n    }\n  if (sigprocmask (SIG_BLOCK, &sigset, &oldsigset) < 0)\n    {\n      fprintf (stderr, \"cannot block signals: %m\\n\");\n      _exit (EXIT_FAILURE);\n    }\n\n  if (do_socket_activation)\n    {\n      char s[32];\n      sprintf (s, \"%d\", getpid());\n      setenv (\"LISTEN_PID\", s, true);\n      setenv (\"LISTEN_FDS\", saved_systemd_listen_fds, true);\n      // Setting fdnames is optional for systemd_socket_activation\n      if (saved_systemd_listen_fdnames != NULL)\n        setenv (\"LISTEN_FDNAMES\", saved_systemd_listen_fdnames, true);\n    }\n\n  setenv (\"_CONTAINERS_USERNS_CONFIGURED\", \"done\", 1);\n  setenv (\"_CONTAINERS_ROOTLESS_UID\", uid, 1);\n  setenv (\"_CONTAINERS_ROOTLESS_GID\", gid, 1);\n","sourceCodeStart":1171,"sourceCodeEnd":1207,"githubUrl":"https://github.com/podman-container-tools/podman/blob/a2409076ef2fef60ad9ac046375dedc7d9410ef4/pkg/rootless/rootless_linux.c#L1171-L1207","documentation":"In the reexec_userns_join child, sigprocmask(SIG_BLOCK, &sigset, &oldsigset) failed right before environment setup, namespace join and exec. Blocking every signal (except SIGCHLD/SIGTERM) protects the setup sequence from interruption. The child _exit(EXIT_FAILURE)s on failure. sigprocmask fails only with EINVAL (invalid how) or EFAULT (bad pointer) — neither is reachable with these valid arguments, so this is defensive/unreachable in practice.","triggerScenarios":"EINVAL/EFAULT from a kernel rejecting valid arguments — plausible only under seccomp filters that return errors for sigprocmask, or memory corruption of the oldsigset destination.","commonSituations":"Essentially never on standard hosts; exotic sandboxes that deliberately fail signal-mask syscalls could surface it.","solutions":["Rerun outside any custom seccomp sandbox that denies sigprocmask","Verify system integrity (libc, podman binary)","If persistent, report upstream with the full environment description"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# verify sigprocmask works in your sandbox before running rootless podman there\npython3 - <<'EOF'\nimport signal, os\nsignal.pthread_sigmask(signal.SIG_BLOCK, {signal.SIGUSR1})\nprint(\"sigprocmask ok\")\nEOF","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Do not run rootless podman under seccomp profiles that deny sigprocmask","Test signal-mask operations in new sandboxes before deploying podman into them","Keep host libc and kernel versions supported by the podman release"],"tags":["podman","rootless","signals","defensive-check","seccomp"],"backgroundTag":null,"analyzedSha":"a2409076ef2fef60ad9ac046375dedc7d9410ef4","analyzedAt":"2026-08-15T15:57:05.625Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}