[BACKPORT/22.1.x] Multiple backports

.changelog/4683.bugfix.md

@@ -0,0 +1,4 @@
+go/worker/compute: Only advertise active version for TEE runtimes
+
+Previously this caused additional downtime on upgrades due to capability
+updates not being allowed.

.changelog/4687.bugfix.md

@@ -0,0 +1,13 @@
+go/runtime/host/sandbox: Properly handle clone3 in seccomp policy
+
+We need to handle the clone3 syscall in a special manner as there are
+several complications to its handling:
+
+- Newer glibc versions will try clone3 first and if they see EPERM they
+  will instantly fail making the program unable to spawn threads.
+
+- The clone3 syscall is much more complex than clone and so we can't
+  simply inspect its flags as we do for clone.
+
+Therefore we need to reject the syscall with ENOSYS, causing fallback to
+clone.

go/runtime/host/sandbox/process/seccomp_linux.go

@@ -355,5 +355,24 @@ func generateSeccompPolicy(out *os.File) error {
 		return err
 	}
 
+	// We need to handle the clone3 syscall in a special manner as there are several complications
+	// to its handling:
+	//
+	// - Newer glibc versions will try clone3 first and if they see EPERM they will instantly fail
+	//   making the program unable to spawn threads.
+	//
+	// - The clone3 syscall is much more complex than clone and so we can't simply inspect its flags
+	//   as above for clone.
+	//
+	// Therefore we need to reject the syscall with ENOSYS, causing fallback to clone.
+	clone3ID, err := seccomp.GetSyscallFromName("clone3")
+	if err != nil {
+		return err
+	}
+	err = filter.AddRule(clone3ID, seccomp.ActErrno.SetReturnCode(int16(syscall.ENOSYS)))
+	if err != nil {
+		return err
+	}
+
 	return filter.ExportBPF(out)
 }

go/worker/compute/executor/committee/node.go

@@ -1532,10 +1532,20 @@ func (n *Node) nudgeAvailability(force bool) {
 
 		n.roleProvider.SetAvailable(func(nd *node.Node) error {
 			for _, version := range n.commonNode.Runtime.HostVersions() {
-				rt := nd.AddOrUpdateRuntime(n.commonNode.Runtime.ID(), version)
-				if rt.Version == n.runtimeVersion {
-					rt.Capabilities.TEE = n.runtimeCapabilityTEE
+				// For TEE-enabled runtimes we can only advertise the active version as this will
+				// otherwise cause additional downtime on upgrades due to capability updates not
+				// being allowed.
+				if n.runtimeCapabilityTEE != nil && version != n.runtimeVersion {
+					continue
+				}
+
+				// Skip sending any old versions that will never be active again.
+				if version.ToU64() < n.runtimeVersion.ToU64() {
+					continue
 				}
+
+				rt := nd.AddOrUpdateRuntime(n.commonNode.Runtime.ID(), version)
+				rt.Capabilities.TEE = n.runtimeCapabilityTEE
 			}
 			return nil
 		})