fix(26.10): sshd login - #38
Merged
Merged
Conversation
openssh 10.4+ aborts the pre-auth child when prctl(PR_SET_SECCOMP) fails, and qemu-user and rosetta refuse that call with EINVAL, so every login into an emulated 26.10 container died before auth. preload a shim into the image's sshd that reports success for that one failure; on real hardware the call succeeds and the sandbox still installs. the shim is cross-compiled in a build-platform stage pinned to the same base, so check_base.sh now swaps the ref inside every FROM line instead of rebuilding the first one, which also keeps the base stage name.
the qemu lanes publish without running the test suite, and a running sshd does not mean spread can log in. start every image, log in with its password, and fail the lane otherwise. qemu setup and a docker load now also run on an image-cache hit, so cached images are checked too.
an sshd that drops every connection before auth used to show up only as spread's "ssh: handshake failed: EOF". before handing the container to spread, retry ssh-keyscan against it and fail with sshd's log if no handshake completes. skipped where the host has no ssh-keyscan.
spread retries a failed allocate script every 5s for 5 minutes, and every attempt left a running container behind, since --rm only fires once the container stops; spread's summary line also dropped the message. remove the container and report through spread's FATAL, which aborts at once and shows the message.
a container that exits before docker port runs left the port empty, and the step spent its 30 retries on an empty port before reporting a misleading login failure. fail straight away instead.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
since r24 the 26.10 images ship openssh 10.5. from 10.4 on, sshd aborts the pre-auth child when it cannot install its seccomp filter, and qemu-user (s390x, ppc64le) and docker desktop's rosetta (amd64 on apple silicon) always refuse it with
EINVAL. so every login into an emulated 26.10 container died withssh_sandbox_child: prctl(PR_SET_SECCOMP): Invalid argument [preauth], and spread aborted withssh: handshake failed: EOF.hack/seccomp-shim.cis anLD_PRELOADshim for the image's sshd: it forwardsprctl()and reports success only whenPR_SET_SECCOMPfails withEINVAL.build-oci.yamlnow log into every image (5 versions x 2 flavours) with the image's password and fail the lane if that doesn't work.pgrepwait, the allocate scripts retryssh-keyscanagainst the container and fail with sshd's log if no handshake completes, instead of leaving spread to report a bareEOF. skipped where the host has nossh-keyscan.