Skip to content

Commit 5cd01b1

Browse files
wwqgtxxwwqgtxx
committed
fix seccomp prevented call to disallowed arm system call 422 on 32bits Androids <= 10
1 parent fb9ffa0 commit 5cd01b1

File tree

6 files changed

+109
-0
lines changed

6 files changed

+109
-0
lines changed

‎.github/patch/disable_pidfd_on_android.patch‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
From 7115c480196f4bdcbdae5e14ebaa4510540680e9 Mon Sep 17 00:00:00 2001
2+
From: Brad Fitzpatrick <bradfitz@tailscale.com>
3+
Date: Tue, 27 Jan 2026 09:52:22 -0800
4+
Subject: [PATCH] [tailscale] os: disable pidfd on Android
5+
6+
Updates tailscale/tailscale#13452
7+
Updates golang/go#70508
8+
Updates tailscale/go#99
9+
---
10+
src/os/pidfd_linux.go | 10 ++++++++++
11+
1 file changed, 10 insertions(+)
12+
13+
diff --git a/src/os/pidfd_linux.go b/src/os/pidfd_linux.go
14+
index 796d8c018c7f2a..5cdbf1175e0db5 100644
15+
--- a/src/os/pidfd_linux.go
16+
+++ b/src/os/pidfd_linux.go
17+
@@ -138,6 +138,16 @@ func (p *Process) pidfdSendSignal(s syscall.Signal) error {
18+
19+
// pidfdWorks returns whether we can use pidfd on this system.
20+
func pidfdWorks() bool {
21+
+ if runtime.GOOS == "android" {
22+
+ // Tailscale-specific workaround since https://github.com/golang/go/pull/69543/commits/aad6b3b32c81795f86bc4a9e81aad94899daf520
23+
+ // does not solve https://github.com/golang/go/issues/69065 for Android apps using Go libraries.
24+
+ //
25+
+ // See: https://github.com/tailscale/tailscale/issues/13452
26+
+ //
27+
+ // For now (2025-04-09), we'll just disable pidfd
28+
+ // on all Android releases.
29+
+ return false
30+
+ }
31+
return checkPidfdOnce() == nil
32+
}
33+

‎.github/patch/remove_64bits_syscall_on_32bit_linux.patch‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
Subject: [PATCH] remove 64bits syscall on 32bit linux
2+
---
3+
Index: src/runtime/os_linux32.go
4+
IDEA additional info:
5+
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
6+
<+>UTF-8
7+
===================================================================
8+
diff --git a/src/runtime/os_linux32.go b/src/runtime/os_linux32.go
9+
--- a/src/runtime/os_linux32.go (revision 030384681641464bf71ed16500075c458363510f)
10+
+++ b/src/runtime/os_linux32.go (date 1771666707318)
11+
@@ -21,14 +21,14 @@
12+
13+
//go:nosplit
14+
func futex(addr unsafe.Pointer, op int32, val uint32, ts *timespec, addr2 unsafe.Pointer, val3 uint32) int32 {
15+
- if !isFutexTime32bitOnly.Load() {
16+
- ret := futex_time64(addr, op, val, ts, addr2, val3)
17+
- // futex_time64 is only supported on Linux 5.0+
18+
- if ret != -_ENOSYS {
19+
- return ret
20+
- }
21+
- isFutexTime32bitOnly.Store(true)
22+
- }
23+
+ //if !isFutexTime32bitOnly.Load() {
24+
+ // ret := futex_time64(addr, op, val, ts, addr2, val3)
25+
+ // // futex_time64 is only supported on Linux 5.0+
26+
+ // if ret != -_ENOSYS {
27+
+ // return ret
28+
+ // }
29+
+ // isFutexTime32bitOnly.Store(true)
30+
+ //}
31+
// Downgrade ts.
32+
var ts32 timespec32
33+
var pts32 *timespec32
34+
@@ -49,14 +49,14 @@
35+
36+
//go:nosplit
37+
func timer_settime(timerid int32, flags int32, new, old *itimerspec) int32 {
38+
- if !isSetTime32bitOnly.Load() {
39+
- ret := timer_settime64(timerid, flags, new, old)
40+
- // timer_settime64 is only supported on Linux 5.0+
41+
- if ret != -_ENOSYS {
42+
- return ret
43+
- }
44+
- isSetTime32bitOnly.Store(true)
45+
- }
46+
+ //if !isSetTime32bitOnly.Load() {
47+
+ // ret := timer_settime64(timerid, flags, new, old)
48+
+ // // timer_settime64 is only supported on Linux 5.0+
49+
+ // if ret != -_ENOSYS {
50+
+ // return ret
51+
+ // }
52+
+ // isSetTime32bitOnly.Store(true)
53+
+ //}
54+
55+
var newts, oldts itimerspec32
56+
var new32, old32 *itimerspec32

‎.github/workflows/build-debug.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,11 @@ jobs:
3232
go-version: "1.26"
3333
check-latest: true # Always check for the latest patch release
3434

35+
- name: Apply Patches
36+
run: |
37+
cd $(go env GOROOT)
38+
for p in $GITHUB_WORKSPACE/.github/patch/*.patch; do patch --verbose -p 1 < "$p"; done
39+
3540
- uses: actions/cache@v4
3641
with:
3742
path: |

‎.github/workflows/build-pre-release.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,11 @@ jobs:
3030
go-version: "1.26"
3131
check-latest: true # Always check for the latest patch release
3232

33+
- name: Apply Patches
34+
run: |
35+
cd $(go env GOROOT)
36+
for p in $GITHUB_WORKSPACE/.github/patch/*.patch; do patch --verbose -p 1 < "$p"; done
37+
3338
- uses: actions/cache@v4
3439
with:
3540
path: |

‎.github/workflows/build-release.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,11 @@ jobs:
3434
go-version: "1.26"
3535
check-latest: true # Always check for the latest patch release
3636

37+
- name: Apply Patches
38+
run: |
39+
cd $(go env GOROOT)
40+
for p in $GITHUB_WORKSPACE/.github/patch/*.patch; do patch --verbose -p 1 < "$p"; done
41+
3742
- uses: actions/cache@v4
3843
with:
3944
path: |

‎.github/workflows/update-dependencies.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,11 @@ jobs:
2626
with:
2727
go-version: "1.26"
2828
check-latest: true # Always check for the latest patch release
29+
30+
- name: Apply Patches
31+
run: |
32+
cd $(go env GOROOT)
33+
for p in $GITHUB_WORKSPACE/.github/patch/*.patch; do patch --verbose -p 1 < "$p"; done
2934
3035
- uses: actions/cache@v4
3136
with:

0 commit comments

Comments
 (0)