Destructor17 opened PR #14803 from webrogue-runtime:android-openat2-api-gate to bytecodealliance:main:
Closes https://github.com/bytecodealliance/wasmtime/issues/14496
Android's Seccomp policy prior API level 37 is to raise a fatal signal on
openat2syscall instead of returningENOSYS, and it makes Wasmtime crash.
Recently released API level 37 finally allowedopenat2(see SECCOMP_ALLOWLIST_COMMON.TXT, it now includesopenat2).Device's API level needs check at runtime. I did my best to avoid dependency on
ndkcrate, sodlsymand some unsafe code is used to detect API level.CHECKEDflag is inspired by crates/wasi/src/filesystem/primitives/unix/freebsd.rs.Tested by running tests from
wasmtime-wasicrate on real Android 13 (API level 33) device and x64 emulator of Android 17 (API level 37). Now all tests pass, with the exception of tests that can't run because Android's SELinux disallows hard links. Testing is done by AI and involved building Rust code usingcargo-ndk, building an Android Gradle project just because running binary directly usingadb shellapplies slightly different Seccomp rules, and other dirty hacks, so I think I shouldn't include such test script. Some manual testing is done too.
Destructor17 requested rvolosatovs for a review on PR #14803.
Destructor17 requested wasmtime-wasi-reviewers for a review on PR #14803.
Destructor17 requested fitzgen for a review on PR #14803.
Destructor17 requested wasmtime-default-reviewers for a review on PR #14803.
github-actions[bot] added the label wasi on PR #14803.
:thumbs_up: alexcrichton submitted PR review:
Thanks!
alexcrichton added PR #14803 Gate Android openat2 by device API level to the merge queue.
:check: alexcrichton merged PR #14803.
alexcrichton removed PR #14803 Gate Android openat2 by device API level from the merge queue.
Last updated: Oct 31 2026 at 23:03 UTC