podman-container-tools/podman · error

cannot block signals: %m

Error message

cannot block signals: %m

What it means

In the reexec_userns_join child, sigprocmask(SIG_BLOCK, &sigset, &oldsigset) failed right before environment setup, namespace join and exec. Blocking every signal (except SIGCHLD/SIGTERM) protects the setup sequence from interruption. The child _exit(EXIT_FAILURE)s on failure. sigprocmask fails only with EINVAL (invalid how) or EFAULT (bad pointer) — neither is reachable with these valid arguments, so this is defensive/unreachable in practice.

Source

Thrown at pkg/rootless/rootless_linux.c:1189

  if (sigfillset (&sigset) < 0)
    {
      fprintf (stderr, "cannot fill sigset: %m\n");
      _exit (EXIT_FAILURE);
    }
  if (sigdelset (&sigset, SIGCHLD) < 0)
    {
      fprintf (stderr, "cannot sigdelset(SIGCHLD): %m\n");
      _exit (EXIT_FAILURE);
    }
  if (sigdelset (&sigset, SIGTERM) < 0)
    {
      fprintf (stderr, "cannot sigdelset(SIGTERM): %m\n");
      _exit (EXIT_FAILURE);
    }
  if (sigprocmask (SIG_BLOCK, &sigset, &oldsigset) < 0)
    {
      fprintf (stderr, "cannot block signals: %m\n");
      _exit (EXIT_FAILURE);
    }

  if (do_socket_activation)
    {
      char s[32];
      sprintf (s, "%d", getpid());
      setenv ("LISTEN_PID", s, true);
      setenv ("LISTEN_FDS", saved_systemd_listen_fds, true);
      // Setting fdnames is optional for systemd_socket_activation
      if (saved_systemd_listen_fdnames != NULL)
        setenv ("LISTEN_FDNAMES", saved_systemd_listen_fdnames, true);
    }

  setenv ("_CONTAINERS_USERNS_CONFIGURED", "done", 1);
  setenv ("_CONTAINERS_ROOTLESS_UID", uid, 1);
  setenv ("_CONTAINERS_ROOTLESS_GID", gid, 1);

View on GitHub (pinned to a2409076ef)

Solutions

1. Rerun outside any custom seccomp sandbox that denies sigprocmask
2. Verify system integrity (libc, podman binary)
3. If persistent, report upstream with the full environment description

# verify sigprocmask works in your sandbox before running rootless podman there
python3 - <<'EOF'
import signal, os
signal.pthread_sigmask(signal.SIG_BLOCK, {signal.SIGUSR1})
print("sigprocmask ok")
EOF

When it happens

Trigger: EINVAL/EFAULT from a kernel rejecting valid arguments — plausible only under seccomp filters that return errors for sigprocmask, or memory corruption of the oldsigset destination.

Common situations: Essentially never on standard hosts; exotic sandboxes that deliberately fail signal-mask syscalls could surface it.

Related errors

• cannot fill sigset: %m
• cannot sigdelset(SIGCHLD): %m
• cannot sigdelset(SIGTERM): %m
• cannot fill sigset: %m\n
• cannot prctl(PR_SET_PDEATHSIG): %m

AI-assisted analysis of podman-container-tools/podman@a2409076ef (2026-08-15). Data as JSON: /api/errors/2e0b59bb6e4da6f4. Report an issue: GitHub.