Firecracker exits with 148 when adding vsock.

[xibz]

using v0.14.0 on Ubuntu 18.04. Get 148 exit code when trying to add vsocks.

[    0.099002] loop: module loaded                                                                                                                                                                              
[    0.100526] tun: Universal TUN/TAP device driver, 1.6                                                                                                                                                        
[    0.102212] hidraw: raw HID events driver (C) Jiri Kosina                                                                                                                                                    
[    0.103293] nf_conntrack version 0.5.0 (2048 buckets, 8192 max)                                                                                                                                              
[    0.104480] ip_tables: (C) 2000-2006 Netfilter Core Team                                                                                                                                                     
[    0.105722] Initializing XFRM netlink socket                                                                                                                                                                 
[    0.106590] NET: Registered protocol family 10                                                                                                                                                               
[    0.107988] Segment Routing with IPv6                                                                                                                                                                        
[    0.108518] NET: Registered protocol family 17
[    0.109102] Bridge firewalling registered
[    0.110027] NET: Registered protocol family 40
2019-01-28T13:27:21.593360060 [anonymous-instance:ERROR:vmm/src/sigsys_handler.rs:70] Shutting down VM after intercepting a bad syscall (16).

[andreeaflorescu]

It looks like we forgot to whitelist a system call for the vsock feature. As a temporary workaround you can set the seccomp level to none when starting Firecracker?

./target/x86_64-unknown-linux-musl/debug/firecracker --context='{"id": "fc1", "jailed": false, "seccomp_level": 0, "start_time_us": 0, "start_time_cpu_us": 0}

This is a rather dummy context, but it can be adjusted.

If you are running with the jailer, you can pass the --secomp-level parameter from command line.

We will get back with a fix.

[xibz]

@andreeaflorescu - Awesome, thank you for the temporary fix and the information.

[mcastelino]

@xibz does vsock work for you with --seccomp-level 0. It does not work for me.

[xibz]

@mcastelino - From what I can tell it works as in I don't get the exit code. However, this isn't with the use of the jailer. I don't think #911 is related to this at least.

[acatangiu]

Fixed by #918