bug#51073: 28.0.60; SIGSYS in emacs-tests/bwrap/allows-stdout

[Philipp Stephani <p.stephani2@gmail.com>]

Am Do., 7. Okt. 2021 um 12:32 Uhr schrieb Basil L. Contovounesios
<contovob@tcd.ie>:
>
> Running 'make test/emacs-tests' fails with status code 159 (where
> 159 = 128 + 31 and 31 = SIGSYS); see the attached compilation log.
>
> Running 'sudo journalctl -g SECCOMP' includes the following:
>
>   Oct 07 10:48:19 tia audit[2156]: SECCOMP auid=1000 uid=1000 gid=1000
>     ses=2 subj==unconfined pid=2156 comm="emacs"
>     exe="/home/blc/.local/src/emacs-28/src/emacs" sig=31 arch=c000003e
>     syscall=157 compat=0 ip=0x7ff4f975629d code=0x80000000
>
>   Oct 07 10:48:20 tia audit[2171]: SECCOMP auid=1000 uid=1000 gid=1000
>     ses=2 subj==unconfined pid=2171 comm="emacs"
>     exe="/home/blc/.local/src/emacs-28/src/emacs" sig=31 arch=c000003e
>     syscall=257 compat=0 ip=0x7ff14b807823 code=0x80000000
>
> AFAICT syscalls 157 and 257 correspond to prctl and openat,
> respectively, and __GI___prctl is mentioned in the attached coredumpctl
> stack trace.  This is confirmed by the ausearch ert-info if I run
> 'sudo make test/emacs-tests' (because ausearch is in my sbin):

Thanks, from the stacktrace I guess the unknown syscall invocation
comes from https://git.kernel.org/pub/scm/libs/libcap/libcap.git/tree/libcap/cap_proc.c?id=d07df10aaa02cf8cfe8047610d2f56dc0be68f1e#n272.
I'll look around a bit whether we should allow or reject that
combination.