{"record":{"id":"733790d81aea43f8","repo":"podman-container-tools/podman","slug":"cannot-fill-sigset-m","errorCode":null,"errorMessage":"cannot fill sigset: %m\n","messagePattern":"cannot fill sigset: %m\n","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/rootless/rootless_linux.c","lineNumber":1174,"sourceCode":"    {\n      int f;\n\n      for (f = 3; f <= open_files_max_fd; f++)\n        if (is_fd_inherited (f))\n          close (f);\n      if (do_socket_activation)\n        {\n          unsetenv (\"LISTEN_PID\");\n          unsetenv (\"LISTEN_FDS\");\n          unsetenv (\"LISTEN_FDNAMES\");\n        }\n\n      return pid;\n    }\n\n  if (sigfillset (&sigset) < 0)\n    {\n      fprintf (stderr, \"cannot fill sigset: %m\\n\");\n      _exit (EXIT_FAILURE);\n    }\n  if (sigdelset (&sigset, SIGCHLD) < 0)\n    {\n      fprintf (stderr, \"cannot sigdelset(SIGCHLD): %m\\n\");\n      _exit (EXIT_FAILURE);\n    }\n  if (sigdelset (&sigset, SIGTERM) < 0)\n    {\n      fprintf (stderr, \"cannot sigdelset(SIGTERM): %m\\n\");\n      _exit (EXIT_FAILURE);\n    }\n  if (sigprocmask (SIG_BLOCK, &sigset, &oldsigset) < 0)\n    {\n      fprintf (stderr, \"cannot block signals: %m\\n\");\n      _exit (EXIT_FAILURE);\n    }\n","sourceCodeStart":1156,"sourceCodeEnd":1192,"githubUrl":"https://github.com/podman-container-tools/podman/blob/a2409076ef2fef60ad9ac046375dedc7d9410ef4/pkg/rootless/rootless_linux.c#L1156-L1192","documentation":"In the child half of reexec_userns_join, sigfillset(&sigset) failed and the child _exit(EXIT_FAILURE)s before joining the namespaces. On Linux sigfillset can only fail with EINVAL (an invalid signal-set argument), which a correct glibc and an uncorrupted stack never produce; this check is defensive, effectively unreachable plumbing.","triggerScenarios":"sigfillset returns -1 with EINVAL: only plausible under memory corruption, a broken libc/kernel ABI mismatch, or hostile LD_PRELOAD interposition of signal functions.","commonSituations":"Practically never observed on healthy systems; if it appears, the process image is already compromised (custom patches, stack smashing, mismatched glibc in a mutated container image).","solutions":["Re-run the command; a one-off occurrence suggests transient corruption","Reinstall/verify the podman binary and container image integrity (rpm -V podman / dpkg -V podman)","Remove custom LD_PRELOAD/patches that hook libc signal functions","If reproducible, capture a core dump and report upstream — this path is not expected to be reachable"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep podman and glibc updated together (matching distro packages)","Never LD_PRELOAD libraries that hook libc signal functions into podman","If it ever fires, capture a core dump - it indicates corruption, not misconfiguration"],"tags":["podman","rootless","signals","defensive-check","unreachable"],"backgroundTag":null,"analyzedSha":"a2409076ef2fef60ad9ac046375dedc7d9410ef4","analyzedAt":"2026-08-15T15:57:05.625Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}