Open sxul opened 3 years ago
Hey, guessing by the error log, this seems like a problem specific to the package (You are building kernel with non-retpoline compiler.
, Please update your compiler.
)
Hey, guessing by the error log, this seems like a problem specific to the package (
You are building kernel with non-retpoline compiler.
,Please update your compiler.
)
emm, the point of the problem is that I can easily compile this package using yay or pakku or makepkg. only rua
can't... I have no idea about this, but I can be sure it has nothing to do with the compiler version.
Understood. Could it be that the build process made a forbidden syscall (restricted via the use of seccomp
in rua)?
If the kernel you're building with supports seccomp audit, you'd be able to see it with grep syscall /var/log/audit/audit.log
Understood. Could it be that the build process made a forbidden syscall (restricted via the use of
seccomp
in rua)? If the kernel you're building with supports seccomp audit, you'd be able to see it withgrep syscall /var/log/audit/audit.log
Sorry, I did not find any helpful information, maybe I did not configure the correct audit rules
Thanks for the reply. It might be sufficient to check whether auditd runs from a systemd point of view, can you check it out? systemctl status auditd.service
If it runs, and if there are no messages containing "syscall" after attempting to build a package, then the problem would not be due to syscalls
Thanks for the reply. It might be sufficient to check whether auditd runs from a systemd point of view, can you check it out?
systemctl status auditd.service
If it runs, and if there are no messages containing "syscall" after attempting to build a package, then the problem would not be due to syscalls
I try to enable auditd service systemctl enable --now auditd
, and I did see some output including the ”syscall“ keyword in the log, but I can’t confirm that they are calls from rua. and these log are all sudo
or whoami
, I think they may be useless.
@sxul do seccomp errors show up prior to starting the build? E.g. tail -Fn1000 /var/log/audit/audit.log | grep syscall
, check if it's empty, then start build, check if things appear there.
I mean, it's not even easy to diagnose the build error reason anyway. Overall, the problem could arise from:
devtmpfs
mount pointtmpfs
tmpfs
(to restrict access to e.g. ~/.ssh
, and in fact any user directories)Essentially I'm using everything bwrap has to offer.
The exact description all security steps taken is here: https://github.com/vn971/rua/blob/master/res/wrap.sh#L13
I'm running
rua install linux-xanmod
, is rua not support build a linux kernel?