procd, branch master

system: report localtime and unixtime as 64 bit values

2026-11-05T14:36:11Z

The "localtime" and "unixtime" fields of "ubus call system info" are added as 32 bit integers, which blobmsg_format_json() prints as signed values. Both turn negative on 2038-01-19 (localtime even earlier, depending on the UTC offset), so LuCI shows a wrong system time. Use blobmsg_add_u64() so the full time_t value is reported. Signed-off-by: Michael Pfeifroth

coldplug: precreate console devices before udevtrigger

2026-11-03T11:42:18Z

ArgosFS x86_64 QEMU reboot-persistence tests use console=ttyS0 with a kernel that does not support devtmpfs. After coldplug replaces /dev, procd fails to reopen its console at STATE_UBUS: "failed to set stdio: No such file or directory". The expected askconsole shell is missing, and the test eventually times out. Precreate /dev/console and, for a single console= argument, the selected tty from sysfs before launching udevtrigger. Match the stock tty hotplug modes (0660, or 0666 for tty) so the normal hotplug pass can retain permissions and set the dialout group. Leave handle_makedev() unchanged. chmod() after EEXIST would incorrectly override modes from earlier non-returning rules. Failure logs: https://github.com/fwerkor/ArgosFS/actions/runs/37110624479 https://github.com/fwerkor/ArgosFS/actions/runs/37581901437 Signed-off-by: Cao Yuhang

service: add workdir support for daemon instances

2026-11-03T11:39:51Z

Allow instances to select a working directory with the workdir option. Change directory after setting the process identity and fail startup if the directory cannot be entered. Preserve the existing behavior when workdir is omitted. Pass the directory to ujail through a new -B option, reusing its existing directory switch after jail setup. Track workdir changes, include the value in instance dumps, and release owned strings. For OCI bundle instances, process.cwd from the bundle takes precedence over workdir because the bundle is parsed after the command-line options. Signed-off-by: Tianling Shen

jail: fix typo in usage output

2026-11-02T15:59:26Z

'remont' should be 'remount'. Fixes: a4505284b4d2 ("jail: reworks & cleanups") Signed-off-by: Daniel Golle

jail: share the live resolv.conf with host-network jails

2026-11-02T15:59:26Z

A jail without its own network namespace gets the host's /etc/resolv.conf bind-mounted, which pins the inode the symlink chain resolves to at start, /tmp/resolv.conf.d/resolv.conf.auto. netifd replaces that file by rename, so a jail started before the uplink had DNS keeps the empty boot-time file for good, and a jailed sysntpd never resolves its servers. Bind /tmp/resolv.conf.d read-only to /dev/resolv.conf.d in such jails and make /etc/resolv.conf a relative symlink into it, set up as for containers with a private netifd. The mount point lives in the /dev ujail builds itself, so read-only and overlay roots work alike. The link targets resolv.conf in that directory when present, else the host's resolved path when it lies there. Otherwise, or when the bundle mounts /etc/resolv.conf itself, the file bind stays. Fixes: 77a6782d6e4e ("jail: mount-bind /etc/resolv.conf for non-netns jails") Signed-off-by: Daniel Golle

service: drop the triggers of a deleted service at once

2026-11-02T15:59:26Z

A deleted service keeps its triggers until its last instance has exited, which can take up to the term timeout. A trigger firing in that window runs the init script action, and a reload of a service that is being deleted starts it again: dnsmasq stopped right before an ifdown comes back on the interface event. Remove the triggers when the service is deleted. A service set again before its instances are gone gets the triggers of that request. Fixes: 961dc692aff7 ("procd: stop service using SIGKILL if SIGTERM failed to do so") Signed-off-by: Daniel Golle

ci: check that read-only jail binds stay read-only

2026-11-01T20:16:59Z

Add a bind suite to every test leg. From a uid 0 jail it writes through -r file, -r src:dst, -b and -r directory binds and opens the jailed program and its ELF interpreter for writing, expecting each to fail with the host file unchanged, and checks that a -w directory stays writable. A jail without CAP_SYS_ADMIN, and one whose seccomp filter denies the mount syscalls, must also fail to remount or unmount any of these, ujail's /dev and the read-only root of -o. The suite also checks the warning for a jail that can undo its read-only mounts: it must appear for a uid 0 jail, a user namespace jail and a jail whose filter only complains, and stay away from a jail without CAP_SYS_ADMIN, a non-root jail, a jail whose filter denies the mount syscalls or kills by default, and every service procd runs in a jail. Signed-off-by: Daniel Golle

jail: warn when the jailed process can undo read-only mounts

2026-11-01T20:16:38Z

Mount flags alone do not keep a jail's read-only mounts read-only: a process that holds CAP_SYS_ADMIN in the jail's user namespace can remount them read-write, unmount them or mount over them, and the kernel locks the flags only of mounts inherited from a more privileged namespace, which ujail's own mounts are not. Jailed services prevent this by dropping CAP_SYS_ADMIN or by a seccomp filter that denies the mount syscalls; nothing tells when a jail has neither. The child decides with prctl() alone, after the capability and identity changes and before exec, whether CAP_SYS_ADMIN survives the exec: it is ambient, or the process runs as uid 0 without SECBIT_NOROOT and the bounding set still holds it. The parent logs a warning when that is the case and no enforcing seccomp filter denies every syscall of the mount family on all paths. seccomp_nr_allows() gains the "allowed on some path" mode this needs; anything it cannot follow counts as allowed there, as do log, trace and user-notification returns. Signed-off-by: Daniel Golle

ci: build procd-seccomp for riscv64

2026-11-01T20:13:16Z

The riscv64 build leaves out procd-seccomp because USE_SECCOMP could not be selected for riscv64, so ujail there was built and tested without seccomp support. OpenWrt's "config: enable SECCOMP support for riscv64 and powerpc64" makes it selectable; build riscv64 with the same package set as every other architecture. Signed-off-by: Daniel Golle

jail: do not lock SECBIT_KEEP_CAPS

2026-11-01T20:00:24Z

With a capability set to apply, ujail locks SECBIT_KEEP_CAPS off before the exec. prctl(PR_SET_KEEPCAPS) then fails with EPERM, so a service that drops to its own user and keeps part of its capabilities across setuid(), as dnsmasq does, cannot start under a capabilities file ("setting capabilities failed: Operation not permitted"). Leave the bit unlocked. It only lets a process keep capabilities it already holds, within the bounding set, and execve() clears it. The OCI runtime specification does not mention securebits, and runc and crun set and clear PR_SET_KEEPCAPS themselves without locking it. Fixes: acf36f2777ae ("jail: seteuid before clone(CLONE_NEWUSER)") Signed-off-by: Daniel Golle