libseccomp version not match

[keloyang]

In a ubuntu with libseccomp 2.2.3, I build runc and then move runc to another ubuntu with libseccomp 2.2.0, runc can run successfully,on the other hand ,in a ubuntu with libseccomp 2.2.0, I build runc and then I move runc to another ubuntu with libseccomp 2.2.3, it will have a error like this:

conditional filtering requires libseccomp version >= 2.2.1

I see the implement,and find the miss match

var (
    // Error thrown on bad filter context
    errBadFilter = fmt.Errorf("filter is invalid or uninitialized")
    // Constants representing library major, minor, and micro versions
    verMajor = int(C.C_VERSION_MAJOR)
    verMinor = int(C.C_VERSION_MINOR)
    verMicro = int(C.C_VERSION_MICRO)
)
func checkVersionAbove(major, minor, micro int) bool {
    return (verMajor > major) ||
        (verMajor == major && verMinor > minor) ||
        (verMajor == major && verMinor == minor && verMicro >= micro)
}

checkVersionAbove will compiled to runc binary, when runc is run , runc don't use the code in libseccomp.so to check the version of libseccomp. So I think we should use some function like C.seccomp_getversion in checkVersionAbove, not the macro.

[crosbymichael]

Yes, there is a tracking issue on the libseccomp repo for this. They didn't support it in the past but it may now. Will have to double check again.

[luxifer]

Still not good... I have libseccomp 2.3.3 and runc still complains... (I have runc version 1.0.0-rc8)

[thaJeztah]

@luxifer the problem can occur if runc is compiled on a platform that has a non-matching version of libseccomp; where did you get the runc package?

[luxifer]

I get it from yocto, same for libseccomp, runc is compiled with the same libseccomp than runtime

[luxifer]

My problems came fro the yocto cache, after rebuilding without cache, runc was finally compiled with the good libseccomp version

[thaJeztah]

Sounds like that may be due to golang/go#24355