add gitlab issues in toml format

1 files changed, 36 insertions, 0 deletions

diff --git a/gitlab/issues/target_missing/host_missing/accel_missing/2116.toml b/gitlab/issues/target_missing/host_missing/accel_missing/2116.toml
new file mode 100644
index 000000000..96da2a351
--- /dev/null
+++ b/gitlab/issues/target_missing/host_missing/accel_missing/2116.toml
@@ -0,0 +1,36 @@
+id = 2116
+title = "[CRASH] OpenGL acceleration except gtk: bad interaction between NVIDIA usermode opengl libraries and QEMU seccomp -sandbox on,spawn=deny, crashes immediately on startup with Bad system call"
+state = "closed"
+created_at = "2024-01-20T20:07:31.997Z"
+closed_at = "2024-05-08T09:11:54.998Z"
+labels = ["GUI", "workflow::Patch available"]
+url = "https://gitlab.com/qemu-project/qemu/-/issues/2116"
+host-os = "Arch Linux"
+host-arch = "x86_64"
+qemu-version = "8.2.0"
+guest-os = "crashes before loaded"
+guest-arch = "all? aarch64, alpha, i386, riscv64 are affected"
+description = """When running any of the above command lines, QEMU crashes with Bad system call (core dumped). Not exclusive to spice; it seems this is caused by QEMU forking during OpenGL initialization after seccomp takes effect."""
+reproduce = """1. Run the above commandline
+2. Notice a Bad system call (core dumped)"""
+additional = """This crash only happens if spawn=deny is set, resourcecontrol/obsolete/elevateprivileges don't cause crashes.
+
+The crash happens around the same time as an audit event is generated in dmesg: `audit: type=1326 audit(1705775880.776:14): auid=MYUSERID uid=MYUID gid=MYGID ses=REDACTED pid=REDACTED comm="qemu-system-x86" exe="/usr/bin/qemu-system-x86_64" sig=31 arch=c000003e syscall=56 compat=0 ip=REDACTED code=REDACTED`
+
+`ausyscall c000003e 56` tells me it's `clone` which (iirc) is the syscall used by glibc to implement fork() (I might be wrong about glibc part)
+
+Suggested solution: move seccomp activation until just before guest code starts executing? make frontends (ie -display gtk/sdl/whatever, including -spice) initialize before seccomp?
+
+Workaround: `chmod -x /bin/nvidia-modprobe` if not using the NVIDIA gpu or use this wrapper script (untested, not enterprise-ready, I am not responsible if unexpected things happen):
+- rename /bin/qemu-system-x86_64 to qemu-system-x86_64.real
+- put this in /bin/qemu-system-x86_64 and chmod +x it
+```sh
+#!/usr/bin/env sh
+chmod -x /bin/nvidia-modprobe
+qemu-system-x86_64.real $@ & disown
+sleep 10 # excessive but maybe safer?
+chmod +x /bin/nvidia-modprobe
+```
+Also, you can use -display gtk,gl=on instead, or (unknown security implications) remove spawn=deny from -sandbox args
+
+original bug report was https://gitlab.com/libvirt/libvirt/-/issues/585 but I realized this was more of a qemu issue than a libvirt one"""