Unfortunately, in order to make the libseccomp API architecture independent, part of the library need to be made architecture dependent; the good news is that the architecture dependent code is rather small and self contained.

Would it be possible for you to grant me access on an ARM system?  If so, I could add the necessary ARM bits to libseccomp.  If that isn't possible, would you be willing to test a series of patches to libseccomp on your ARM system?

Red Hat has a number of ARM devices they can give you access to, not being a Red Hat employee I can't do that, but I've added Brendan to the CC: and he can sort that for you.

Great, thanks for the connection.  I'll follow up with Brendan and update the BZ when I've got something to share.

Unfortunately, the upstream kernel does not have the necessary functionality to make libseccomp useful on ARM (see HAVE_ARCH_SECCOMP_FILTER).  I'm going to mark libseccomp as x86/x86_64 only via ExclusiveArch to solve this in the short term; when the ARM kernel adds the necessary support we can revisit this.

Scratch build:

* http://koji.fedoraproject.org/koji/taskinfo?taskID=4231825

Package patch:

diff --git a/libseccomp.spec b/libseccomp.spec
index d88b80d..f0695aa 100644
--- a/libseccomp.spec
+++ b/libseccomp.spec
@@ -1,7 +1,8 @@
 Summary: Enhanced seccomp library
 Name: libseccomp
 Version: 0.1.0
-Release: 0%{?dist}
+Release: 1%{?dist}
+ExclusiveArch: %{ix86} x86_64
 License: LGPLv2
 Group: System Environment/Libraries
 Source: http://downloads.sf.net/project/libseccomp/%{name}-%{version}.tar.gz
@@ -62,6 +63,8 @@ make DESTDIR="%{buildroot}" install
 %{_mandir}/man3/*
 
 %changelog
+* Tue Jul 10 2012 Paul Moore <pmoore> - 0.1.0-1
+- Limit package to x86/x86_64 platforms (RHBZ #837888)
 * Tue Jun 12 2012 Paul Moore <pmoore> - 0.1.0-0
 - Initial version

Committed to the Fedora repository (a912323351377d8fdfd98ee811c96ebce33ebf5d) and built successfully on i686 and x86_64.  This should at least resolve the build failure in such a way as that RPM will be smart and recognize that it shouldn't build libseccomp on ARM.

* http://koji.fedoraproject.org/koji/taskinfo?taskID=4231835

Should we close this bug for now?  We can revisit the issue when the ARM kernel gains the necessary support.

OK, that's cool. Are there any packages that have hard dependencies on or will have hard deps (linked against) in the F-18 timeframe that may impact this as well?

Is there any links that detail or document the ARCH_SECCOMP_FILTER kernel requirements so we can document it?

As or right now there are no other packages that rely on libseccomp, although I do expect QEMU to gain libseccomp support in the F18 timeframe; however, that should be easy enough to make architecture dependent at build/configure time.

Below is a snippet from the Documentation/prctl/seccomp_filter.txt file in the Linux Kernel source tree; it provides the basic on information on the architecture dependent SECCOMP_FILTER code.

  Adding architecture support
  -----------------------
  See arch/Kconfig for the authoritative requirements.  In general, if an
  architecture supports both ptrace_event and seccomp, it will be able to
  support seccomp filter with minor fixup: SIGSYS support and seccomp return
  value checking.  Then it must just add CONFIG_HAVE_ARCH_SECCOMP_FILTER
  to its arch-specific Kconfig.

I'm going to go ahead and close this bug, we'll revisit the issue when the kernel gains the necessary support.

It looks like seccomp kernel support for ARM will be in 3.8 

https://lwn.net/Articles/522044/

Great.  I figured it would only be a matter of time ...

I'm going to reopen this bug so we can track this work.

It's landed in 3.8 based on cross referencing the patches at the link below and what's in kernel master now.

http://thread.gmane.org/gmane.linux.kernel/1387301

I looked at the libseccomp 2.0.0 release and while it has mentions of other arches it's not clear whether other arches are actually supported in the release.

The libseccomp 2.0.0 release didn't mention support for new architectures but rather new APIs, and lots of under-the-covers improvements, to make it easier to deal with multiple and non-native architectures.  In short, the 2.0.0 release lays the foundation for adding new architectures but doesn't actually add any new architectures, that will be coming in future 2.x releases.

Also, as a FYI, RFC patches to add support for ARM were posted to the libseccomp mailing list last week.  I'm currently working on some new "live" tests for automated testing framework that will allow us to better qualify/validate libseccomp on a given architecture (the current tests are all simulator based).

A quick update: it appears that the 3.8-rcX kernels aren't booting on Fedora ARM at present; until that is fixed we're blocked.

please be more specific. What HW? They work fine in the koji buildroots.

Earlier on the RH #arm IRC channel I asked around if any of the farm systems were booting 3.8-rcX yet and the answer was "no, not yet".

that's not the same, most of the farm systems run stable not rawhide

Okay, well let me rephrase then: until I get access to an ARM system running 3.8 I'm blocked.  At present the only option I am aware of is the ARM farm, if you know of another option please let me know.

This bug appears to have been reported against 'rawhide' during the Fedora 19 development cycle.
Changing version to '19'.

(As we did not run this process for some time, it could affect also pre-Fedora 19 development
cycle bugs. We are very sorry. It will help us with cleanup during Fedora 19 End Of Life. Thank you.)

More information and reason for this action is here:
https://fedoraproject.org/wiki/BugZappers/HouseKeeping/Fedora19

I just pushed an update to libseccomp to both F19 and Rawhide, libseccomp-2.1.0-0, which should resolve this issue by adding support for ARM.

libseccomp-2.1.0-0.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/libseccomp-2.1.0-0.fc19

Package libseccomp-2.1.0-0.fc19:
* should fix your issue,
* was pushed to the Fedora 19 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing libseccomp-2.1.0-0.fc19'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-10872/libseccomp-2.1.0-0.fc19
then log in and leave karma (feedback).

libseccomp-2.1.0-0.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.