Skip to content

Error executing hook oci-seccomp-bpf-hook on arm64 #200

@Barnoux

Description

@Barnoux

Description

I am encountering an error when trying to run a Podman container with the annotation io.containers.trace-syscall=of:/tmp/ls.json. The error message is:

Error: OCI runtime error: crun: error executing hook `/usr/libexec/oci/hooks.d/oci-seccomp-bpf-hook` (exit code: 1)

Steps to Reproduce

Run the following command on arm64 architecture,

sudo podman run --annotation io.containers.trace-syscall=of:/tmp/ls.json fedora:30 ls / > /dev/null

Expected Behavior

The container should run successfully with system call tracing enabled.

Actual Behavior

The container fails to start with the error message shown above.

Environment

Podman version: 5.4.2
crun version: 1.21
Operating System: Debian 13 (trixie)
Architecture: arm64

How oci-seccomp-bpf hook was installed

sudo apt-get install oci-seccomp-bpf-hook

The hook script /usr/libexec/oci/hooks.d/oci-seccomp-bpf-hook exists and has the correct permissions.

Running the hook script manually with --help shows the following usage

Usage of /usr/libexec/oci/hooks.d/oci-seccomp-bpf-hook:
  -i string
      Path of the input file
  -o string
      Path of the output file
  -r int
      Trace the specified PID
  -s
      Start tracing and read the state spec from stdin
  -version
      Print the version

Logs

No relevant logs found in journalctl.

Additionnal info

I don't have the bug when using x86_64 architecture.
At first i was launching oci-seccomp-bpf-hook from raspberrypi 4B and i got the error. But before writing the issue, i built a VM from virt-maanger with qemu-system-aarch64 to verify if my issue is linked to the raspberrypi 4B, but i don't think so.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions