Your message dated Wed, 16 Sep 2026 17:46:31 +0200
with message-id <[email protected]>
and subject line
has caused the Debian Bug report #1129470,
regarding glycin: i386 processes on amd64, e.g. Steam, result in bwrap crash
with SIGSYS and non-sandboxed loaders
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1129470: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1129470
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: libglycin-2-0
Version: 2.0.8-1
Severity: important
Tags: forky sid upstream
Forwarded: https://gitlab.gnome.org/GNOME/glycin/-/issues/269
Control: affects -1 + steam-installer libgdk-pixbuf-2.0-0 bubblewrap
X-Debbugs-Cc: [email protected]
Original steps to reproduce
---------------------------
* GNOME desktop environment (possibly others, I've only tested GNOME)
* Run Steam, which is a 32-bit (i386) executable that uses gdk-pixbuf
via GTK; on recent distros, gdk-pixbuf in turn uses glycin
* Lock the screen, which for whatever reason results in Steam's main
process invoking gdk-pixbuf and therefore glycin
Simplified steps to reproduce
-----------------------------
* Have an amd64 system with i386 foreign architecture,
libgdk-pixbuf-2.0-dev:i386 installed, bubblewrap:amd64 installed
* Compile the simple gdk-pixbuf program below as an i386 executable
* e.g. i686-linux-gnu-gcc -ot t.c $(i686-linux-gnu-pkgconf --cflags --libs
gdk-pixbuf-2.0)
* Run `./t`
----8<----
#include <gdk-pixbuf/gdk-pixbuf.h>
int main (void)
{
GError *error = NULL;
GdkPixbuf *px = gdk_pixbuf_new_from_file
("/usr/share/pixmaps/debian-logo.png", &error);
g_assert_no_error (error);
return (px != NULL) ? 0 : 1;
}
----8<----
Expected result
---------------
The host program (Steam or my simplified test program) successfully runs
Glycin loaders in a bubblewrap sandbox.
Actual result
-------------
bubblewrap is terminated by `SIGSYS` when glycin runs `true` to probe
whether sandboxing is possible, resulting in a crash / core dump. The
systemd Journal reports something like this:
kernel: audit: type=1326 audit(1772398687.390:171): auid=1000 uid=1000 gid=1000
ses=2 subj=unconfined pid=165156 comm="bwrap" exe="/usr/bin/bwrap" sig=31
arch=c000003e syscall=59 compat=0 ip=0x7f50bbec3097 code=0x0
kernel: audit: type=1326 audit(1772398687.390:172): auid=1000 uid=1000 gid=1000
ses=2 subj=unconfined pid=165155 comm="bwrap" exe="/usr/bin/bwrap" sig=31
arch=c000003e syscall=61 compat=0 ip=0x7f50bbe73e92 code=0x0
As a result glycin falls back to running the loaders un-sandboxed.
Workarounds
-----------
Someone who knows enough Rust (sorry, that's not me) could patch glycin
so that when compiled for i386, it applies a seccomp filter that allows
both i386 and x86_64 syscalls. That wouldn't fully solve the problem,
but would deal with the most common case.
Failing that, we could avoid the SIGSYS and core dump by disabling glycin
in i386 builds of gdk-pixbuf. Again, that wouldn't fully solve the problem but
would deal with the most common case.
I think a full solution would require structural changes upstream. See
the upstream bug report for details.
--- End Message ---
--- Begin Message ---
Version: 2.2.1+ds-1
--
Matthias Geiger <werdahias>
Debian Developer -- KiCad Contributor
GPG: ECBEDBB607B9B2BE
--- End Message ---
