podman-container-tools/podman · critical

cannot sigdelset(SIGTERM): %m\n

Error message

cannot sigdelset(SIGTERM): %m\n

What it means

Printed at pkg/rootless/rootless_linux.c:1349 in reexec_in_user_namespace()'s child branch when sigdelset(&sigset, SIGTERM) fails. The code fills a signal set, deletes SIGCHLD and SIGTERM so those two stay deliverable, then blocks everything else with sigprocmask(SIG_BLOCK). Since sigfillset() succeeded and SIGTERM is a valid constant, a failure here means the sigset_t was corrupted or the libc is broken — it is a defensive, near-unreachable branch that ends with _exit(EXIT_FAILURE).

Source

Thrown at pkg/rootless/rootless_linux.c:1349

          unsetenv ("LISTEN_FDS");
          unsetenv ("LISTEN_FDNAMES");
        }
      return pid;
    }

  if (sigfillset (&sigset) < 0)
    {
      fprintf (stderr, "cannot fill sigset: %m\n");
      _exit (EXIT_FAILURE);
    }
  if (sigdelset (&sigset, SIGCHLD) < 0)
    {
      fprintf (stderr, "cannot sigdelset(SIGCHLD): %m\n");
      _exit (EXIT_FAILURE);
    }
  if (sigdelset (&sigset, SIGTERM) < 0)
    {
      fprintf (stderr, "cannot sigdelset(SIGTERM): %m\n");
      _exit (EXIT_FAILURE);
    }
  if (sigprocmask (SIG_BLOCK, &sigset, &oldsigset) < 0)
    {
      fprintf (stderr, "cannot block signals: %m\n");
      _exit (EXIT_FAILURE);
    }

  argv = get_cmd_line_args (NULL);
  if (argv == NULL)
    {
      fprintf (stderr, "cannot read argv: %m\n");
      _exit (EXIT_FAILURE);
    }

  argv0 = argv[0];

  if (do_socket_activation)

View on GitHub (pinned to a2409076ef)

Solutions

1. Rebuild from clean sources and test with ASan/valgrind to rule out stack/sigset corruption.
2. Sanity-check the libc with a standalone sigfillset/sigdelset(SIGTERM) test program; if it fails, fix or replace the libc.
3. Check for hardware/OOM corruption: run memtest or inspect dmesg for OOM killer activity.
4. If reproducible on a supported distro, file an upstream containers/podman issue with full environment details.

# minimal environment check before invoking rootless podman
env | grep '^LD_PRELOAD=' && echo 'warning: LD_PRELOAD present, unset it for testing'
ldd --version | head -1

When it happens

Trigger: Rootless podman bootstrap (reexec_in_user_namespace child) where sigdelset of the constant SIGTERM returns -1 after sigfillset and sigdelset(SIGCHLD) both succeeded: memory corruption of the sigset variable or a defective libc.

Common situations: Not seen in practice on mainstream systems; only plausible with custom/old libc builds, stack corruption from a third-party patch, or faulty hardware (RAM errors). It aborts the rootless child before the uid/gid map handshake, so the podman command fails at startup.

Related errors

• cannot sigdelset(SIGCHLD): %m\n
• cannot block signals: %m\n
• cannot read argv: %m
• cannot fill sigset: %m
• cannot sigdelset(SIGCHLD): %m

AI-assisted analysis of podman-container-tools/podman@a2409076ef (2026-08-15). Data as JSON: /api/errors/1ca510103e9d5a70. Report an issue: GitHub.