podman-container-tools/podman · error

cannot fill sigset: %m\n

Error message

cannot fill sigset: %m\n

What it means

In the child half of reexec_in_user_namespace (after the CLONE_NEWUSER|CLONE_NEWNS fork succeeded and the parent returned), sigfillset(&sigset) failed and the child _exit(EXIT_FAILURE)s before reading the ready pipe. This initializes the signal mask later used to protect namespace configuration. sigfillset can only fail with EINVAL for an invalid set argument, so on a healthy glibc this check is defensive and effectively unreachable.

Source

Thrown at pkg/rootless/rootless_linux.c:1339

          num_fds = strtol (saved_systemd_listen_fds, NULL, 10);
          if (num_fds != LONG_MIN && num_fds != LONG_MAX)
            {
              int f;

              for (f = 3; f < num_fds + 3; f++)
                if (is_fd_inherited (f))
                  close (f);
            }
          unsetenv ("LISTEN_PID");
          unsetenv ("LISTEN_FDS");
          unsetenv ("LISTEN_FDNAMES");
        }
      return pid;
    }

  if (sigfillset (&sigset) < 0)
    {
      fprintf (stderr, "cannot fill sigset: %m\n");
      _exit (EXIT_FAILURE);
    }
  if (sigdelset (&sigset, SIGCHLD) < 0)
    {
      fprintf (stderr, "cannot sigdelset(SIGCHLD): %m\n");
      _exit (EXIT_FAILURE);
    }
  if (sigdelset (&sigset, SIGTERM) < 0)
    {
      fprintf (stderr, "cannot sigdelset(SIGTERM): %m\n");
      _exit (EXIT_FAILURE);
    }
  if (sigprocmask (SIG_BLOCK, &sigset, &oldsigset) < 0)
    {
      fprintf (stderr, "cannot block signals: %m\n");
      _exit (EXIT_FAILURE);
    }

View on GitHub (pinned to a2409076ef)

Solutions

1. Rerun to rule out transient corruption
2. Verify podman and glibc integrity; remove LD_PRELOAD hooks
3. Report upstream with kernel/glibc versions if it reproduces

When it happens

Trigger: Memory corruption of the stack sigset_t, a broken libc ABI, or interposed signal functions via LD_PRELOAD returning an error.

Common situations: Should never occur in normal operation; appearance indicates a damaged process image rather than a tunable configuration.

Related errors

• cannot fill sigset: %m
• cannot sigdelset(SIGCHLD): %m
• cannot sigdelset(SIGTERM): %m
• cannot block signals: %m
• cannot sigdelset(SIGCHLD): %m\n

AI-assisted analysis of podman-container-tools/podman@a2409076ef (2026-08-15). Data as JSON: /api/errors/479450055b5f021f. Report an issue: GitHub.