diff options
Diffstat (limited to 'gitlab/issues_text/target_missing/host_missing/accel_missing/2116')
| -rw-r--r-- | gitlab/issues_text/target_missing/host_missing/accel_missing/2116 | 28 |
1 files changed, 0 insertions, 28 deletions
diff --git a/gitlab/issues_text/target_missing/host_missing/accel_missing/2116 b/gitlab/issues_text/target_missing/host_missing/accel_missing/2116 deleted file mode 100644 index a47655df2..000000000 --- a/gitlab/issues_text/target_missing/host_missing/accel_missing/2116 +++ /dev/null @@ -1,28 +0,0 @@ -[CRASH] OpenGL acceleration except gtk: bad interaction between NVIDIA usermode opengl libraries and QEMU seccomp -sandbox on,spawn=deny, crashes immediately on startup with Bad system call -Description of problem: -When running any of the above command lines, QEMU crashes with Bad system call (core dumped). Not exclusive to spice; it seems this is caused by QEMU forking during OpenGL initialization after seccomp takes effect. -Steps to reproduce: -1. Run the above commandline -2. Notice a Bad system call (core dumped) -Additional information: -This crash only happens if spawn=deny is set, resourcecontrol/obsolete/elevateprivileges don't cause crashes. - -The crash happens around the same time as an audit event is generated in dmesg: `audit: type=1326 audit(1705775880.776:14): auid=MYUSERID uid=MYUID gid=MYGID ses=REDACTED pid=REDACTED comm="qemu-system-x86" exe="/usr/bin/qemu-system-x86_64" sig=31 arch=c000003e syscall=56 compat=0 ip=REDACTED code=REDACTED` - -`ausyscall c000003e 56` tells me it's `clone` which (iirc) is the syscall used by glibc to implement fork() (I might be wrong about glibc part) - -Suggested solution: move seccomp activation until just before guest code starts executing? make frontends (ie -display gtk/sdl/whatever, including -spice) initialize before seccomp? - -Workaround: `chmod -x /bin/nvidia-modprobe` if not using the NVIDIA gpu or use this wrapper script (untested, not enterprise-ready, I am not responsible if unexpected things happen): -- rename /bin/qemu-system-x86_64 to qemu-system-x86_64.real -- put this in /bin/qemu-system-x86_64 and chmod +x it -```sh -#!/usr/bin/env sh -chmod -x /bin/nvidia-modprobe -qemu-system-x86_64.real $@ & disown -sleep 10 # excessive but maybe safer? -chmod +x /bin/nvidia-modprobe -``` -Also, you can use -display gtk,gl=on instead, or (unknown security implications) remove spawn=deny from -sandbox args - -original bug report was https://gitlab.com/libvirt/libvirt/-/issues/585 but I realized this was more of a qemu issue than a libvirt one |