{"record":{"id":"5b387f5ea7cc5e1e","repo":"podman-container-tools/podman","slug":"cannot-sigdelset-sigterm-m","errorCode":null,"errorMessage":"cannot sigdelset(SIGTERM): %m\n","messagePattern":"cannot sigdelset\\(SIGTERM\\): %m\n","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/rootless/rootless_linux.c","lineNumber":1184,"sourceCode":"          unsetenv (\"LISTEN_FDNAMES\");\n        }\n\n      return pid;\n    }\n\n  if (sigfillset (&sigset) < 0)\n    {\n      fprintf (stderr, \"cannot fill sigset: %m\\n\");\n      _exit (EXIT_FAILURE);\n    }\n  if (sigdelset (&sigset, SIGCHLD) < 0)\n    {\n      fprintf (stderr, \"cannot sigdelset(SIGCHLD): %m\\n\");\n      _exit (EXIT_FAILURE);\n    }\n  if (sigdelset (&sigset, SIGTERM) < 0)\n    {\n      fprintf (stderr, \"cannot sigdelset(SIGTERM): %m\\n\");\n      _exit (EXIT_FAILURE);\n    }\n  if (sigprocmask (SIG_BLOCK, &sigset, &oldsigset) < 0)\n    {\n      fprintf (stderr, \"cannot block signals: %m\\n\");\n      _exit (EXIT_FAILURE);\n    }\n\n  if (do_socket_activation)\n    {\n      char s[32];\n      sprintf (s, \"%d\", getpid());\n      setenv (\"LISTEN_PID\", s, true);\n      setenv (\"LISTEN_FDS\", saved_systemd_listen_fds, true);\n      // Setting fdnames is optional for systemd_socket_activation\n      if (saved_systemd_listen_fdnames != NULL)\n        setenv (\"LISTEN_FDNAMES\", saved_systemd_listen_fdnames, true);\n    }","sourceCodeStart":1166,"sourceCodeEnd":1202,"githubUrl":"https://github.com/podman-container-tools/podman/blob/a2409076ef2fef60ad9ac046375dedc7d9410ef4/pkg/rootless/rootless_linux.c#L1166-L1202","documentation":"In the reexec_userns_join child, sigdelset(&sigset, SIGTERM) failed — SIGTERM is removed from the blocked set so PR_SET_PDEATHSIG(SIGTERM) can later deliver the parent-death signal (set at line 1208). Failure aborts the child with _exit(EXIT_FAILURE). As with the sibling checks, EINVAL on the constant SIGTERM is not reachable on a correct system; this is defensive validation of the signal-mask dance.","triggerScenarios":"Only under memory corruption of the sigset_t or a broken/interposed libc returning EINVAL for a valid signal number.","commonSituations":"Not seen in normal operation; indicates underlying corruption or a hostile environment rather than any user-configurable trigger.","solutions":["Rerun; if deterministic, isolate with a minimal reproducer outside your environment","Check binary and libc integrity; remove custom preload libraries","Report upstream with the podman version, kernel and glibc versions"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat as environmental corruption - no configuration knob leads here","Keep the runtime environment stock (no preload/interposition of signal APIs)","Preserve full stderr plus environment info when reporting to upstream"],"tags":["podman","rootless","signals","defensive-check","unreachable"],"backgroundTag":null,"analyzedSha":"a2409076ef2fef60ad9ac046375dedc7d9410ef4","analyzedAt":"2026-08-15T15:57:05.625Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}