faccessat2 syscall needed for Docker (needs backported from libseccomp 2.4.4+)

[Alex]

The next release of Alpine Linux intends to use the faccessat2(2) syscall for access(3). This currently fails under Ubuntu Docker, regardless of using the separate Docker package repository, since it forbids faccessat2.

This bug is similar to bug #1876055, but requests backporting of 2.4.4 instead of 2.4.3. I believe this change is likely low risk and can be applied to all supported Ubuntu versions.

Alternatively, I also see in bug #1891810 that libseccomp 2.5 is being considered for backporting. This would also be acceptable for our purposes, but is obviously a higher-risk change for Ubuntu.

[Bryce Harrington (bryce)]

Yes, your referenced bug LP: #1891810 looks like the most likely path forward for gaining this, given that the ubuntu-security team already has that staged in their security-proposed PPA (https://launchpad.net/~ubuntu-security-proposed/+archive/ubuntu/ppa).

Please test that PPA to confirm it resolves the issue for you, and if it does, verify so on LP: #1891810 to help move that forward. If that lands, then this bug can be duped to that one.

If the version in the PPA does not resolve the issue, or if it does but for some reason does not appear to be likely to land for focal, please follow up here.

[Balint Reczey (rbalint)]

The fix for https://github.com/seccomp/libseccomp/issues/314 seems to be needed, too, also for migrating glibc 2.33.

[Alex (hello71)]

As far as I can tell, that only affects C programs using libseccomp. Docker passes strings and so should not be impacted.