podman-container-tools/podman · error

cannot sigdelset(SIGTERM): %m

Error message

cannot sigdelset(SIGTERM): %m

What it means

In the reexec_userns_join child, sigdelset(&sigset, SIGTERM) failed — SIGTERM is removed from the blocked set so PR_SET_PDEATHSIG(SIGTERM) can later deliver the parent-death signal (set at line 1208). Failure aborts the child with _exit(EXIT_FAILURE). As with the sibling checks, EINVAL on the constant SIGTERM is not reachable on a correct system; this is defensive validation of the signal-mask dance.

Source

Thrown at pkg/rootless/rootless_linux.c:1184

          unsetenv ("LISTEN_FDNAMES");
        }

      return pid;
    }

  if (sigfillset (&sigset) < 0)
    {
      fprintf (stderr, "cannot fill sigset: %m\n");
      _exit (EXIT_FAILURE);
    }
  if (sigdelset (&sigset, SIGCHLD) < 0)
    {
      fprintf (stderr, "cannot sigdelset(SIGCHLD): %m\n");
      _exit (EXIT_FAILURE);
    }
  if (sigdelset (&sigset, SIGTERM) < 0)
    {
      fprintf (stderr, "cannot sigdelset(SIGTERM): %m\n");
      _exit (EXIT_FAILURE);
    }
  if (sigprocmask (SIG_BLOCK, &sigset, &oldsigset) < 0)
    {
      fprintf (stderr, "cannot block signals: %m\n");
      _exit (EXIT_FAILURE);
    }

  if (do_socket_activation)
    {
      char s[32];
      sprintf (s, "%d", getpid());
      setenv ("LISTEN_PID", s, true);
      setenv ("LISTEN_FDS", saved_systemd_listen_fds, true);
      // Setting fdnames is optional for systemd_socket_activation
      if (saved_systemd_listen_fdnames != NULL)
        setenv ("LISTEN_FDNAMES", saved_systemd_listen_fdnames, true);
    }

View on GitHub (pinned to a2409076ef)

Solutions

1. Rerun; if deterministic, isolate with a minimal reproducer outside your environment
2. Check binary and libc integrity; remove custom preload libraries
3. Report upstream with the podman version, kernel and glibc versions

When it happens

Trigger: Only under memory corruption of the sigset_t or a broken/interposed libc returning EINVAL for a valid signal number.

Common situations: Not seen in normal operation; indicates underlying corruption or a hostile environment rather than any user-configurable trigger.

Related errors

• cannot fill sigset: %m
• cannot sigdelset(SIGCHLD): %m
• cannot fill sigset: %m\n
• cannot block signals: %m
• cannot sigdelset(SIGCHLD): %m\n

AI-assisted analysis of podman-container-tools/podman@a2409076ef (2026-08-15). Data as JSON: /api/errors/5b387f5ea7cc5e1e. Report an issue: GitHub.