{"record":{"id":"35d24db8842fa6f2","repo":"podman-container-tools/podman","slug":"cannot-block-signals-m-n","errorCode":null,"errorMessage":"cannot block signals: %m\\n","messagePattern":"cannot block signals: %m\\\\n","errorType":"console","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/rootless/rootless_linux.c","lineNumber":1354,"sourceCode":"\n  if (sigfillset (&sigset) < 0)\n    {\n      fprintf (stderr, \"cannot fill sigset: %m\\n\");\n      _exit (EXIT_FAILURE);\n    }\n  if (sigdelset (&sigset, SIGCHLD) < 0)\n    {\n      fprintf (stderr, \"cannot sigdelset(SIGCHLD): %m\\n\");\n      _exit (EXIT_FAILURE);\n    }\n  if (sigdelset (&sigset, SIGTERM) < 0)\n    {\n      fprintf (stderr, \"cannot sigdelset(SIGTERM): %m\\n\");\n      _exit (EXIT_FAILURE);\n    }\n  if (sigprocmask (SIG_BLOCK, &sigset, &oldsigset) < 0)\n    {\n      fprintf (stderr, \"cannot block signals: %m\\n\");\n      _exit (EXIT_FAILURE);\n    }\n\n  argv = get_cmd_line_args (NULL);\n  if (argv == NULL)\n    {\n      fprintf (stderr, \"cannot read argv: %m\\n\");\n      _exit (EXIT_FAILURE);\n    }\n\n  argv0 = argv[0];\n\n  if (do_socket_activation)\n    {\n      char s[32];\n      sprintf (s, \"%d\", getpid());\n      setenv (\"LISTEN_PID\", s, true);\n      setenv (\"LISTEN_FDS\", saved_systemd_listen_fds, true);","sourceCodeStart":1336,"sourceCodeEnd":1372,"githubUrl":"https://github.com/podman-container-tools/podman/blob/a2409076ef2fef60ad9ac046375dedc7d9410ef4/pkg/rootless/rootless_linux.c#L1336-L1372","documentation":"Printed at pkg/rootless/rootless_linux.c:1354 when sigprocmask(SIG_BLOCK, &sigset, &oldsigset) fails in the freshly cloned userns child of reexec_in_user_namespace(). The set was just validated by sigfillset/sigdelset, and on Linux sigprocmask fails only with EINVAL (invalid set) — so this branch is effectively unreachable barring libc/memory problems. It _exit()s the child, killing the rootless re-exec.","triggerScenarios":"Any rootless podman invocation (podman unshare, rootless container start, socket activation) where sigprocmask(SIG_BLOCK) returns <0 after the set was successfully built — i.e. corrupted sigset_t/oldsigset storage or a broken libc signal implementation.","commonSituations":"Theoretically defensive only. In the wild it would surface right after clone(CLONE_NEWUSER|CLONE_NEWNS), making every rootless podman command fail instantly with 'cannot block signals'. Look for abnormal environments: LD_PRELOAD signal-interposing libraries (some malware/sandbox injectors), musl/uClibc mismatches, corrupted binary.","solutions":["Check for LD_PRELOAD libraries that interpose signal functions and disable them for a test run.","Rebuild with ASan to detect sigset_t corruption, and verify the podman binary is not corrupted (rpm -V / debsums).","Confirm libc integrity with a minimal sigprocmask test program.","If it persists on stock software, report upstream to containers/podman with the podman info output."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"env -u LD_PRELOAD podman info >/dev/null 2>&1 || echo 'rootless env suspect; check libc/preload'\nrpm -V podman 2>/dev/null || debsums -s podman 2>/dev/null || echo 'verify podman binary integrity'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Exclude podman processes from security agents that interpose signal functions.","Mount /usr (and wherever podman lives) exec and not corrupted; verify package files periodically.","Never ignore repeated 'cannot block signals' at clone time — capture a core and report upstream."],"tags":["podman","rootless","userns","signals","c","libc"],"backgroundTag":null,"analyzedSha":"a2409076ef2fef60ad9ac046375dedc7d9410ef4","analyzedAt":"2026-08-15T15:57:05.625Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}