podman-container-tools/podman · error

cannot fill sigset: %m

Error message

cannot fill sigset: %m

What it means

In the child half of reexec_userns_join, sigfillset(&sigset) failed and the child _exit(EXIT_FAILURE)s before joining the namespaces. On Linux sigfillset can only fail with EINVAL (an invalid signal-set argument), which a correct glibc and an uncorrupted stack never produce; this check is defensive, effectively unreachable plumbing.

Source

Thrown at pkg/rootless/rootless_linux.c:1174

    {
      int f;

      for (f = 3; f <= open_files_max_fd; f++)
        if (is_fd_inherited (f))
          close (f);
      if (do_socket_activation)
        {
          unsetenv ("LISTEN_PID");
          unsetenv ("LISTEN_FDS");
          unsetenv ("LISTEN_FDNAMES");
        }

      return pid;
    }

  if (sigfillset (&sigset) < 0)
    {
      fprintf (stderr, "cannot fill sigset: %m\n");
      _exit (EXIT_FAILURE);
    }
  if (sigdelset (&sigset, SIGCHLD) < 0)
    {
      fprintf (stderr, "cannot sigdelset(SIGCHLD): %m\n");
      _exit (EXIT_FAILURE);
    }
  if (sigdelset (&sigset, SIGTERM) < 0)
    {
      fprintf (stderr, "cannot sigdelset(SIGTERM): %m\n");
      _exit (EXIT_FAILURE);
    }
  if (sigprocmask (SIG_BLOCK, &sigset, &oldsigset) < 0)
    {
      fprintf (stderr, "cannot block signals: %m\n");
      _exit (EXIT_FAILURE);
    }

View on GitHub (pinned to a2409076ef)

Solutions

1. Re-run the command; a one-off occurrence suggests transient corruption
2. Reinstall/verify the podman binary and container image integrity (rpm -V podman / dpkg -V podman)
3. Remove custom LD_PRELOAD/patches that hook libc signal functions
4. If reproducible, capture a core dump and report upstream — this path is not expected to be reachable

When it happens

Trigger: sigfillset returns -1 with EINVAL: only plausible under memory corruption, a broken libc/kernel ABI mismatch, or hostile LD_PRELOAD interposition of signal functions.

Common situations: Practically never observed on healthy systems; if it appears, the process image is already compromised (custom patches, stack smashing, mismatched glibc in a mutated container image).

Related errors

• cannot sigdelset(SIGCHLD): %m
• cannot sigdelset(SIGTERM): %m
• cannot fill sigset: %m\n
• cannot block signals: %m
• cannot sigdelset(SIGCHLD): %m\n

AI-assisted analysis of podman-container-tools/podman@a2409076ef (2026-08-15). Data as JSON: /api/errors/733790d81aea43f8. Report an issue: GitHub.