From fb9a575766ff4f729bee0d40d040aea96a89da31 Mon Sep 17 00:00:00 2001 From: Alois Wohlschlager Date: Sat, 7 Mar 2026 11:53:12 +0100 Subject: [PATCH] libstore: fix builder launch failure on older kernels Since commit ac64c727b540dc876ac65f523a875148ae911f13, during launch of the builder it is attempted to raise all capabilities into the ambient set. Specifically, what "all" means here is determined by the Linux API headers Lix was built against. Occasionally, new capabilities are added in the Linux kernel, leading to PR_CAP_AMBIENT_RAISE failing with EINVAL on the newly added capabilities if the API headers are from after the change but the running kernel is from before. Similarly to how capset already silently ignores nonexistent capabilities, we ignore this error so the builder doesn't fail to launch unnecessarily. Unfortunately it is very hard to test for this situation currently, since the last time a capability was added was CAP_CHECKPOINT_RESTORE in Linux 5.9, and all kernel versions in nixpkgs are newer than that. Change-Id: Ibeb2f0757729b877bd3ca9f02e1aa4536a6a6964 --- lix/libstore/platform/linux.cc | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/lix/libstore/platform/linux.cc b/lix/libstore/platform/linux.cc index 4bbd08021..a95384201 100644 --- a/lix/libstore/platform/linux.cc +++ b/lix/libstore/platform/linux.cc @@ -230,7 +230,10 @@ static void raiseAmbientCaps(std::span caps) } for (auto cap : caps) { - if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, cap, 0, 0) < 0) { + // We might be running on a kernel older than the API headers, lacking some capabilities. + // While capset will silently ignore them, PR_CAP_AMBIENT_RAISE fails with EINVAL. + // Swallow the error ourselves to not introduce unnecessary failures. + if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, cap, 0, 0) < 0 && errno != EINVAL) { throw SysError("couldn't set ambient caps"); } }