I am writing an app which spawns an external process (a ported Linux app which in turn spawns other processes). This will ultimately be done in a separate thread, but for testing purposes, I am spawning the process from the UI thread (processing output in a separate thread).
The external process binary is written in OCaml and was built as a static binary for a Linux target with the same ABI.
On Anbox (based on Android 7) this works as expected and the process completes normally. On a real device running LineageOS 18.1 (Android 11), the process starts and produces some output, but after a few seconds ends returning exit code 159.
As per my research, this indicates abnormal termination (exit code > 128) on signal 31 (exit code minus 128).
On Linux, 31 is the code for SIGSYS as well as SIGUNUSED, both on x86 and ARM platforms. Not sure if Android uses the same numeric values for signals, but I suspect it inherited them from Linux.
SIGSYS would indicate that the process passed a bad argument to a system call, or that it violated Linux Seccomp rules (source). Android introduces seccomp-bpf in zygote starting with version 8 (source). Thus an operation that violates seccomp-bpf rules on Android 8+ (and thus on the LOS device) would not per se cause errors on Android <=7 (and thus on Anbox), which further corroborates my suspicion.
The logcat does not provide a single clue as to why the process was terminated.
How can I find out if the process actually did violate seccomp-bpf policies, and if so, details of the policy violation?
Disclaimer: I am aware that what I am doing (specifically, launching external process from an app) is discouraged by Google, and have actively chosen not to follow recommendations and to circumvent restrictions. Anyone following my example should be aware that the resulting app will violate Play Store policies (for targeting an API version below the required minimum), and will rely on a legacy feature which may get cut off altogether in future Android versions, rendering the app unusable.
