From 3da64b56e07109aa59054cfea02ee6e31d2ebcb0 Mon Sep 17 00:00:00 2001 From: zbarsky-openai Date: Mon, 24 Aug 2026 06:11:38 -0400 Subject: [PATCH] vm: enable session keyrings in both guest kernels A sandbox test executed inside actiond starts its bundled minijail binary, but the guest kernel does not implement the key management system calls: ```text libminijail[10]: keyctl(KEYCTL_JOIN_SESSION_KEYRING) failed: Function not implemented libminijail[9]: child process 10 received signal 6 ``` Enable Linux key retention support in both guest kernel configurations. Minijail's existing `-w` option can then create its isolated anonymous session keyring without requiring any additional runtime packages. The exact failure was reproduced by a real remote execution of `//project/oai_sandbox:pytest -k test_seccomp_default_action`, after enabling Landlock and providing the consumer's source-built `libcap.so.2`. Both independent fragments were resolved through the repository's actual Linux 6.18.2 Kconfig parser in `allnoconfig` mode, verifying `CONFIG_KEYS=y` and its automatically selected `CONFIG_ASSOCIATIVE_ARRAY=y` on ARM64 and x86_64. --- vm/linux.config | 1 + vm/linux_x86_64.config | 1 + 2 files changed, 2 insertions(+) diff --git a/vm/linux.config b/vm/linux.config index 69abcd9..d6e0c17 100644 --- a/vm/linux.config +++ b/vm/linux.config @@ -38,6 +38,7 @@ CONFIG_HYPERV_VSOCKETS=y CONFIG_INET=y CONFIG_JBD2=y CONFIG_KALLSYMS=y +CONFIG_KEYS=y CONFIG_MEMCG=y CONFIG_MISC_FILESYSTEMS=y CONFIG_MULTIUSER=y diff --git a/vm/linux_x86_64.config b/vm/linux_x86_64.config index 278a71f..d038391 100644 --- a/vm/linux_x86_64.config +++ b/vm/linux_x86_64.config @@ -35,6 +35,7 @@ CONFIG_FUTEX=y CONFIG_INET=y CONFIG_JBD2=y CONFIG_KALLSYMS=y +CONFIG_KEYS=y CONFIG_KERNEL_LZ4=y CONFIG_KVM_GUEST=y CONFIG_MEMCG=y