podman-container-tools/podman · critical

cannot block signals: %m\n

Error message

cannot block signals: %m\n

What it means

Printed at pkg/rootless/rootless_linux.c:1354 when sigprocmask(SIG_BLOCK, &sigset, &oldsigset) fails in the freshly cloned userns child of reexec_in_user_namespace(). The set was just validated by sigfillset/sigdelset, and on Linux sigprocmask fails only with EINVAL (invalid set) — so this branch is effectively unreachable barring libc/memory problems. It _exit()s the child, killing the rootless re-exec.

Source

Thrown at pkg/rootless/rootless_linux.c:1354

  if (sigfillset (&sigset) < 0)
    {
      fprintf (stderr, "cannot fill sigset: %m\n");
      _exit (EXIT_FAILURE);
    }
  if (sigdelset (&sigset, SIGCHLD) < 0)
    {
      fprintf (stderr, "cannot sigdelset(SIGCHLD): %m\n");
      _exit (EXIT_FAILURE);
    }
  if (sigdelset (&sigset, SIGTERM) < 0)
    {
      fprintf (stderr, "cannot sigdelset(SIGTERM): %m\n");
      _exit (EXIT_FAILURE);
    }
  if (sigprocmask (SIG_BLOCK, &sigset, &oldsigset) < 0)
    {
      fprintf (stderr, "cannot block signals: %m\n");
      _exit (EXIT_FAILURE);
    }

  argv = get_cmd_line_args (NULL);
  if (argv == NULL)
    {
      fprintf (stderr, "cannot read argv: %m\n");
      _exit (EXIT_FAILURE);
    }

  argv0 = argv[0];

  if (do_socket_activation)
    {
      char s[32];
      sprintf (s, "%d", getpid());
      setenv ("LISTEN_PID", s, true);
      setenv ("LISTEN_FDS", saved_systemd_listen_fds, true);

View on GitHub (pinned to a2409076ef)

Solutions

1. Check for LD_PRELOAD libraries that interpose signal functions and disable them for a test run.
2. Rebuild with ASan to detect sigset_t corruption, and verify the podman binary is not corrupted (rpm -V / debsums).
3. Confirm libc integrity with a minimal sigprocmask test program.
4. If it persists on stock software, report upstream to containers/podman with the podman info output.

env -u LD_PRELOAD podman info >/dev/null 2>&1 || echo 'rootless env suspect; check libc/preload'
rpm -V podman 2>/dev/null || debsums -s podman 2>/dev/null || echo 'verify podman binary integrity'

When it happens

Trigger: Any rootless podman invocation (podman unshare, rootless container start, socket activation) where sigprocmask(SIG_BLOCK) returns <0 after the set was successfully built — i.e. corrupted sigset_t/oldsigset storage or a broken libc signal implementation.

Common situations: Theoretically defensive only. In the wild it would surface right after clone(CLONE_NEWUSER|CLONE_NEWNS), making every rootless podman command fail instantly with 'cannot block signals'. Look for abnormal environments: LD_PRELOAD signal-interposing libraries (some malware/sandbox injectors), musl/uClibc mismatches, corrupted binary.

Related errors

• cannot sigdelset(SIGCHLD): %m\n
• cannot sigdelset(SIGTERM): %m\n
• cannot read argv: %m
• cannot fill sigset: %m
• cannot sigdelset(SIGCHLD): %m

AI-assisted analysis of podman-container-tools/podman@a2409076ef (2026-08-15). Data as JSON: /api/errors/35d24db8842fa6f2. Report an issue: GitHub.