/usr/bin/tar: Cannot change mode to rwxr-xr-x: Operation not permitted

[AshwinHIBM]

Description
I'm getting the above error for a number of files with Fedora-40 only on ppc64le at https://github.com/docker/docker-ce-packaging/blob/master/rpm/Makefile#L44 when it runs the instruction /usr/lib/rpm/rpmuncompress -x /root/rpmbuild/SOURCES/engine.tgz only while running with the default seccomp profile.

Steps to Reproduce
Run the instruction

docker run --rm -e PLATFORM -v /workspace/docker-ce-packaging/rpm/rpmbuild/SOURCES:/root/rpmbuild/SOURCES:ro -v /workspace/docker-ce-packaging/rpm/rpmbuild/fedora-40/RPMS:/root/rpmbuild/RPMS -v /workspace/docker-ce-packaging/rpm/rpmbuild/fedora-40/SRPMS:/root/rpmbuild/SRPMS  rpmbuild-fedora-40/ppc64le -ba --define '_gitcommit_cli 2ae903e' --define '_gitcommit_engine 8b79278' --define '_release 1' --define '_version 26.0.0' --define '_origversion v26.0.0' --define '_buildx_rpm_version 0.13.1' --define '_buildx_version v0.13.1' --define '_buildx_gitcommit 7884339' --define '_compose_rpm_version 2.25.0' --define '_compose_version v2.25.0'  SPECS/docker-ce.spec SPECS/docker-ce-cli.spec SPECS/docker-ce-rootless-extras.spec SPECS/docker-buildx-plugin.spec SPECS/docker-compose-plugin.spec`

I tried replacing the default profile with a custom one including the system calls obtained from strace but that didn't help so there might be a missing call.

@thaJeztah @neersighted Can you please advise?

[thaJeztah]

What version of docker are you running on? And with Fedora 40, you mean you're building on Fedora 40, or building packages for Fedora 40 on your machine?

[AshwinHIBM]

What version of docker are you running on? And with Fedora 40, you mean you're building on Fedora 40, or building packages for Fedora 40 on your machine?

Trying to build packages for Fedora-40 on our system for Docker v26.0.0. Sorry for the ambiguous wording. The system is a Debian bookworm container.

[thaJeztah]

Oh! Didn't even notice it was you (didn't look at who reported it). Hm.. yes, this looks like the same issue as we ran into with
armhf and Ubuntu 24.0.4; as we know what's running in these containers, and are running on ephemeral machines, we went for a "quick fix" there, and disabled seccomp;

• [master] disable seccomp to prevent tar EPERM (Ubuntu 24.04 armhf on 20.04 host) #1007

But ultimately we need to update the seccomp profile;

• RFE: Reworking Seccomp Profiles to ENOSYS Default moby/moby#42871

I need to see if we can get consensus with the maintainers on that change, but let me open a PR to disable seccomp in the meantime.