Starting with dev-lang/python-3.10.0_alpha2, sandbox causes subprocess.Popen() to hang indefinitely sometimes. This happens e.g. in test_ctypes. The relevant upstream change is enabling use of vfork() in place of fork() when possible, see: https://github.com/python/cpython/commit/976da903a746a5455998e9ca45fbc4d3ad3479d8 I'm going to paste the gdb backtrace shortly.
backtrace: #0 0x00007f11e423be16 in __GI___wait4 (pid=88, stat_loc=0x7ffca5198988, options=0, usage=0x0) at ../sysdeps/unix/sysv/linux/wait4.c:30 #1 0x00007f11e47422a9 in trace_loop () at /usr/src/debug/sys-apps/sandbox-2.20/sandbox-2.20/libsandbox/trace.c:454 #2 0x00007f11e47425d6 in trace_main (filename=0x7f11e21ded70 "/sbin/ldconfig", argv=0x7f11e24caf30) at /usr/src/debug/sys-apps/sandbox-2.20/sandbox-2.20/libsandbox/trace.c:523 #3 0x00007f11e47469b4 in sb_check_exec (filename=0x7f11e21ded70 "/sbin/ldconfig", argv=0x7f11e24caf30) at /usr/src/debug/sys-apps/sandbox-2.20/sandbox-2.20/libsandbox/wrapper-funcs/__wrapper_exec.c:242 #4 0x00007f11e4746c4a in execve_DEFAULT (path=0x7f11e21ded70 "/sbin/ldconfig", argv=0x7f11e24caf30, envp=0x7f11e2275a50) at /usr/src/debug/sys-apps/sandbox-2.20/sandbox-2.20/libsandbox/wrapper-funcs/__wrapper_exec.c:307 #5 0x00007f11e2f00070 in child_exec (exec_array=0x7f11e21ded50, argv=0x7f11e24caf30, envp=0x7f11e2275a50, cwd=0x0, p2cread=3, p2cwrite=-1, c2pread=4, c2pwrite=5, errread=-1, errwrite=3, errpipe_read=6, errpipe_write=7, close_fds=1, restore_signals=1, call_setsid=0, call_setgid=0, gid=3796400240, call_setgroups=0, groups_size=0, groups=0x0, call_setuid=0, uid=32764, child_umask=-1, child_sigmask=0x7ffca5199300, py_fds_to_keep=0x7f11e2473790, preexec_fn=0x7f11e47135a0 <_Py_NoneStruct>, preexec_fn_args_tuple=0x0) at /var/tmp/portage/dev-lang/python-3.10.0_alpha6/work/Python-3.10.0a6/Modules/_posixsubprocess.c:642 #6 0x00007f11e2f00329 in do_fork_exec (exec_array=0x7f11e21ded50, argv=0x7f11e24caf30, envp=0x7f11e2275a50, cwd=0x0, p2cread=3, p2cwrite=-1, c2pread=4, c2pwrite=5, errread=-1, errwrite=3, errpipe_read=6, errpipe_write=7, close_fds=1, restore_signals=1, call_setsid=0, call_setgid=0, gid=3796400240, call_setgroups=0, groups_size=0, groups=0x0, call_setuid=0, uid=32764, child_umask=-1, child_sigmask=0x7ffca5199300, py_fds_to_keep=0x7f11e2473790, preexec_fn=0x7f11e47135a0 <_Py_NoneStruct>, preexec_fn_args_tuple=0x0) at /var/tmp/portage/dev-lang/python-3.10.0_alpha6/work/Python-3.10.0a6/Modules/_posixsubprocess.c:746 #7 0x00007f11e2f00e8f in subprocess_fork_exec (module=0x7f11e2e5ea40, args=0x7f11e22d6790) at /var/tmp/portage/dev-lang/python-3.10.0_alpha6/work/Python-3.10.0a6/Modules/_posixsubprocess.c:1016 #8 0x00007f11e444cc19 in cfunction_call (func=0x7f11e2e5ea90, args=0x7f11e22d6790, kwargs=0x0) at Objects/methodobject.c:548 #9 0x00007f11e43f91ad in _PyObject_MakeTpCall (tstate=0x55f064564050, callable=0x7f11e2e5ea90, args=0x55f064868880, nargs=21, keywords=0x0) at Objects/call.c:215 [...]
My totally random guess is that Python uses vfork() with specific assumption of what's going to happen before exec() overwrites the process, while sandbox does random stuff in-process.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8e8d98d11d8b67a0051647bcf41fc942b0ed1686 commit 8e8d98d11d8b67a0051647bcf41fc942b0ed1686 Author: Michał Górny <mgorny@gentoo.org> AuthorDate: 2021-03-03 12:47:14 +0000 Commit: Michał Górny <mgorny@gentoo.org> CommitDate: 2021-03-03 12:54:01 +0000 dev-lang/python: Disable vfork() to workaround sandbox bug Bug: https://bugs.gentoo.org/774054 Signed-off-by: Michał Górny <mgorny@gentoo.org> .../{python-3.10.0_alpha6.ebuild => python-3.10.0_alpha6-r1.ebuild} | 5 +++++ 1 file changed, 5 insertions(+)
Created attachment 689607 [details, diff] 0001-libsandbox-implement-vfork-via-fork.patch
(In reply to Sergei Trofimovich from comment #4) > Created attachment 689607 [details, diff] [details, diff] > 0001-libsandbox-implement-vfork-via-fork.patch Can you update the copyright line and push it?
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/proj/sandbox.git/commit/?id=f43378e14396fe5fad05bff13a73483740205881 commit f43378e14396fe5fad05bff13a73483740205881 Author: Sergei Trofimovich <slyfox@gentoo.org> AuthorDate: 2021-03-06 09:02:32 +0000 Commit: Sergei Trofimovich <slyfox@gentoo.org> CommitDate: 2021-03-11 08:03:04 +0000 libsandbox: implement vfork() via fork() sandbox turns vfork()/exec("/sbin/ldconfig") into vfork()/ptrace()+fork()/exec("/sbin/ldconfig"). It happens because "/sbin/ldconfig" is a static binary and can't be inspected via LD_PRELOAD and sandbox falls back to fork()+ptrace() vfork() imposes very strong requirements on what could happen between vfork() and exec(). Above sandbox behaviour violates it. vfork() is specified in a way that it can always can be substituted for fork(). This change does exactly that. Reported-by: Michał Górny Bug: https://bugs.gentoo.org/774054 Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org> libsandbox/symbols.h.in | 1 + libsandbox/wrapper-funcs/vfork.c | 28 ++++++++++++++++++++++++++++ 2 files changed, 29 insertions(+)
The bug has been closed via the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=006f51f6f783911b912c72ac6f9144dbc402b7f7 commit 006f51f6f783911b912c72ac6f9144dbc402b7f7 Author: Michał Górny <mgorny@gentoo.org> AuthorDate: 2021-03-11 08:59:56 +0000 Commit: Michał Górny <mgorny@gentoo.org> CommitDate: 2021-03-11 09:52:37 +0000 sys-apps/sandbox: Bump to 2.21 Closes: https://bugs.gentoo.org/774054 Signed-off-by: Michał Górny <mgorny@gentoo.org> sys-apps/sandbox/Manifest | 1 + sys-apps/sandbox/sandbox-2.21.ebuild | 74 ++++++++++++++++++++++++++++++++++++ 2 files changed, 75 insertions(+)
