procd, branch master

jail/seccomp: complete the pre-main syscall allowlists

2026-09-25T14:53:05Z

The loader and pre-main allowlists name the syscalls a 64-bit libc issues before the workload reaches its entry point. A 32-bit libc sets its thread pointer with set_tls on ARM and set_thread_area on MIPS and i386, and maps and inspects its objects with mmap2, fstat64, fstatat64, statx, fcntl64 and the 64-suffixed statfs calls; glibc and bionic also read the stack limit with ugetrlimit or getrlimit there. None of these are in the lists, so the first syscall of ld.so already hits the profile's default action and a SCMP_ACT_KILL_PROCESS profile kills the jailed process before the entry breakpoint, which is how umdns dies on every 32-bit target. A static glibc binary further resolves its origin in _dl_non_dynamic_init(), reading the /proc/self/exe link with readlinkat before main, which the static pre-main list omits as well. Add the names to the lists so the grants and the deltas that revoke them stay in step; find_syscall() skips a name the target does not have. Fixes: f15d0c407c09 ("jail: apply OCI seccomp filters via ptrace syscall injection") Fixes: openwrt/openwrt#25392 Signed-off-by: Daniel Golle

jail: do not leave a freed uci network path behind

2026-09-22T17:53:08Z

run_netifd() frees uci_config_network when it gives up, and asprintf() leaves it undefined when it fails, but both paths leave the pointer set. jail_network_teardown() only checks it for NULL, so it unlinks and frees whatever is there a second time when the container is torn down. Clear the pointer on both paths. Fixes: c44ab7fa061f ("jail: netifd: generate netifd uci config and mount it") Signed-off-by: Daniel Golle

jail: fail a container whose netifd cannot start

2026-09-22T17:53:08Z

jail_network_start() waited five seconds for the container's ubus socket and then carried on regardless, so a container whose only network never came up was started anyway and was useless. The bound was also a guess that has nothing to do with how long the socket takes. Wait on events instead: the socket appearing, or procd reporting that it has given up restarting the private ubusd, which is the only way the socket can fail to appear. A wait that ends without netifd now fails the container rather than starting it without a network. Fixes: 1eb4371e2534 ("jail: start ubus and netifd instances for container with netns") Signed-off-by: Daniel Golle

jail: let procd respawn the container's private ubusd

2026-09-22T17:53:08Z

The private ubusd is added as an ordinary procd instance with no respawn attribute, so procd starts it once and never again. A container whose ubusd dies keeps a socket file that nothing listens on, and everything inside it that talks to ubus, the jail's own netifd included, is stuck for as long as the container runs. Ask for a respawn with no values of its own, which leaves procd its defaults, so the sidecar is supervised like any other service. Fixes: 1eb4371e2534 ("jail: start ubus and netifd instances for container with netns") Signed-off-by: Daniel Golle

jail: keep a late netifd start from ending a foreign loop

2026-09-22T17:53:08Z

jail_network_start() waits for the container's ubus socket in a nested loop, and both run_netifd() and the give-up timeout leave that loop with uloop_end(). Once the give-up has fired the inotify watch stays armed, so a socket that appears later runs run_netifd() from whatever loop is current by then and ends that one instead, which exits ujail and takes the container down with it. End the wait only while it is actually running, and drop the watch once nothing more is expected from it, on teardown and when arming fails. The descriptor now starts out invalid so that disarming before it is armed cannot close an unrelated one. Fixes: 1eb4371e2534 ("jail: start ubus and netifd instances for container with netns") Signed-off-by: Daniel Golle

jail: keep a private netifd loop from ending the main loop

2026-09-22T17:53:08Z

uloop_end() sets one global flag and uloop_run() clears it only on entry. jail_network_start() runs a private nested loop while it waits for the container's ubus socket, and run_netifd() ends that loop the only way there is, so the flag stays set after the nested loop returns. Without prestart hooks the startup chain runs synchronously, so a jail started with -i sends the start byte and returns into the loop in main(), which sees the stale flag and exits with status 0, tearing the container down moments after it came up. A jail waiting for a start command enters a further loop first, which clears the flag, so only the immediate path breaks, and that is the path uxc boot uses to autostart containers. Clear the flag where the private loop is owned. Fixes: 1eb4371e2534 ("jail: start ubus and netifd instances for container with netns") Signed-off-by: Daniel Golle

jail: refuse weightDevice leafWeight before reading it

2026-09-22T17:53:08Z

The per-device leaf weight is refused because the unified hierarchy has no counterpart for it, but the value is read and range checked first, so a leaf weight above CGROUP_IO_WEIGHT_MAX answers ERANGE and reports the number as wrong when the field is not implemented at any value. Refuse it before reading, as the container-wide leaf weight now does. devleafweight and leafweight are left without a reader once the read is gone, and go with it. Fixes: 16159bb1f70f ("jail: parse OCI cgroups resources") Signed-off-by: Daniel Golle

service: copy validation rule strings with a known length

2026-09-22T17:53:08Z

service_validate_add() sizes each vrule with strlen() and then fills it with strcpy(), so the allocation and the copy take their length from two separate evaluations of the same blobmsg accessor. GCC cannot relate the two and rejects the copy under -Warray-bounds: service/validate.c:152:17: error: 'strcpy' offset 6 from the object at 'cur' is out of the bounds of referenced subobject 'name' with type 'uint8_t[]' at offset 6 [-Werror=array-bounds=] The read is in bounds. blobmsg_name() casts blob_attr.data[] to struct blobmsg_hdr and hands back its name[] member, so the compiler sees a flexible array member of a nested object, gives it zero extent and refuses every access at the resulting constant offset 6. The attribute really owns blobmsg_hdrlen(namelen) bytes, which covers the name and its terminator. Keep the lengths the allocation already computed and copy with memcpy(). The bound then comes from the expression that sized the buffer rather than from a second walk of the same string, which is what makes the relationship between the two visible, to a reader and to the compiler alike. Signed-off-by: Daniel Golle

instance, service: signal instances through a pidfd

2026-09-22T17:53:08Z

in->proc.pid is assigned only in instance_start() and never reset, so an instance of a service registered with autostart:false still holds the calloc()'d 0 when service.signal reaches service_handle_kill(). kill(0, sig) then signals procd's whole process group, which for PID 1 is ubusd, netifd, logd and procd itself. Hold a pidfd instead, as ujail already does for the jailed process. instance_start() obtains it with pidfd_open() right after fork(), where the pid cannot yet have been recycled because libubox reaps only from the event loop; instance_exit() closes it once uloop has reaped the child and instance_free() closes it for an instance torn down while running, so a respawn always opens a fresh one and a never-started instance keeps the -1 set by instance_init(). instance_signal() now fails with ESRCH instead of signalling anything when no process is live, which service_handle_kill() maps to UBUS_STATUS_NOT_FOUND. kill() remains only for a failed pidfd_open(), gated on uloop still tracking the child so that it cannot be reached with an unset or stale pid. Fixes: 28f584ff290d ("service: add service.signal ubus call") Signed-off-by: Daniel Golle

jail, uxc: run the poststop hooks at delete time

2026-09-22T17:53:08Z

runtime-spec v1.3.0 runtime.md#lifecycle puts the poststop hooks at step 13, after the container is destroyed and before delete returns. ujail runs them when the container process is reaped and exits at once, so they land between steps 10 and 11, before any delete. Park a registered container in the stopped state and drive the hooks from a delete instead, either the new method on container., whose reply is deferred until the chain has finished, or the SIGTERM procd sends an instance it is tearing down. A delete asked for before the container has stopped is honoured rather than parked, which is what a forced delete and every procd-driven stop look like; otherwise procd would SIGKILL the parked supervisor and the hooks would be skipped. uxc waits for the deferred reply or for ubus.object.remove of container., whichever comes first: ubusd_proto_free_client() frees a dead client's objects without answering anyone blocked on them, so a ujail that died mid-invoke would never release the caller. A seccomp handshake that failed on an already reaped payload stops exiting on its own, and uxc drops a stopped incarnation before creating over it, instance_update() having nothing to do for a pending process and an unchanged config. A netifd restart still runs the hooks at payload exit, re-execing in place with no delete behind it. Fixes: fc9f614bf701 ("jail: parse and run OCI hooks") Signed-off-by: Daniel Golle