diff options
author | Andreas Müller <schnitzeltony@gmail.com> | 2020-09-20 19:26:52 +0200 |
---|---|---|
committer | Martin Jansa <Martin.Jansa@gmail.com> | 2020-11-03 17:01:34 +0100 |
commit | 5a1689d2ad5763305422692a578efc6b4afb0e3b (patch) | |
tree | cffc482132fa22bbc1f85fbf943bc5f9e2299c32 | |
parent | 23161db6a22507c7cc901541e4748870863cf168 (diff) | |
download | meta-qt5-5a1689d2ad5763305422692a578efc6b4afb0e3b.tar.gz |
qtwebengine: Fix sandbox freeze for glibc >= 2.31 on 32 bit systems
* patch was taken from meta-browser. The only modification done was adding the
error seen
Backport of afcde8567252191820ed07abcc241f3794b75988
Signed-off-by: Andreas Müller <schnitzeltony@gmail.com>
-rw-r--r-- | recipes-qt/qt5/qtwebengine/chromium/0013-chromium-Fix-sandbox-Aw-snap-for-syscalls-403-and-40.patch | 139 | ||||
-rw-r--r-- | recipes-qt/qt5/qtwebengine_git.bb | 1 |
2 files changed, 140 insertions, 0 deletions
diff --git a/recipes-qt/qt5/qtwebengine/chromium/0013-chromium-Fix-sandbox-Aw-snap-for-syscalls-403-and-40.patch b/recipes-qt/qt5/qtwebengine/chromium/0013-chromium-Fix-sandbox-Aw-snap-for-syscalls-403-and-40.patch new file mode 100644 index 00000000..1b43fcbb --- /dev/null +++ b/recipes-qt/qt5/qtwebengine/chromium/0013-chromium-Fix-sandbox-Aw-snap-for-syscalls-403-and-40.patch | |||
@@ -0,0 +1,139 @@ | |||
1 | From 5aa69767be0fbbc7a3a5075c6c94366a535c99a8 Mon Sep 17 00:00:00 2001 | ||
2 | From: =?UTF-8?q?Andreas=20M=C3=BCller?= <schnitzeltony@gmail.com> | ||
3 | Date: Mon, 20 Apr 2020 23:56:48 +0200 | ||
4 | Subject: [PATCH] chromium: Fix sandbox 'Aw, snap' for syscalls 403 and 407 | ||
5 | MIME-Version: 1.0 | ||
6 | Content-Type: text/plain; charset=UTF-8 | ||
7 | Content-Transfer-Encoding: 8bit | ||
8 | |||
9 | Taken as is from meta-browser. Saw my application freeze for syscall 0407 | ||
10 | trouble: | ||
11 | |||
12 | | ../../../../git/src/3rdparty/chromium/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc:**CRASHING**:seccomp-bpf failure in syscall 0407 | ||
13 | |||
14 | Original commit message: | ||
15 | |||
16 | * syscall 403: reported by ArchLinux users [1-2] | ||
17 | * syscall 407: reported by me [3] | ||
18 | |||
19 | Looking at [4-5] it seems that glibc (>=2.31?) introduced extra syscalls for | ||
20 | 32Bit systems to handle time64: | ||
21 | |||
22 | * __NR_clock_gettime -> __NR_clock_gettime64 | ||
23 | * __NR_clock_nanosleep -> __NR_clock_nanosleep_time64 | ||
24 | |||
25 | To fix | ||
26 | | ../../sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc:**CRASHING**:seccomp-bpf failure in syscall 0403 | ||
27 | | ../../sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc:**CRASHING**:seccomp-bpf failure in syscall 0407 | ||
28 | |||
29 | we handle new systemcalls in the same way as 64bit systems do and 32bit systems | ||
30 | did before glibc 2.31. | ||
31 | |||
32 | [1] https://bugs.archlinux32.org/index.php?do=details&task_id=105 | ||
33 | [2] https://bbs.archlinux32.org/viewtopic.php?id=2897 | ||
34 | [3] https://github.com/OSSystems/meta-browser/issues/357 | ||
35 | [4] https://sourceware.org/git/?p=glibc.git;a=commit;h=2e44b10b42d68d9887ccab17b76db5d7bbae4fb6 | ||
36 | [5] https://github.com/bminor/glibc/blob/019d828669df966dc4ef2684fce0b1c17bef9aae/sysdeps/unix/sysv/linux/clock_gettime.c#L30 | ||
37 | |||
38 | Upstream Status: Pending [Have no idea where to send this] | ||
39 | |||
40 | Signed-off-by: Andreas Müller <schnitzeltony@gmail.com> | ||
41 | Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> | ||
42 | --- | ||
43 | .../sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc | 9 ++++++++- | ||
44 | .../syscall_parameters_restrictions_unittests.cc | 6 ++++++ | ||
45 | .../sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc | 6 ++++++ | ||
46 | .../sandbox/linux/system_headers/arm_linux_syscalls.h | 8 ++++++++ | ||
47 | .../sandbox/linux/system_headers/mips_linux_syscalls.h | 8 ++++++++ | ||
48 | 5 files changed, 36 insertions(+), 1 deletion(-) | ||
49 | |||
50 | diff --git a/chromium/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc b/chromium/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc | ||
51 | index 768025ce192..87025d91785 100644 | ||
52 | --- a/chromium/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc | ||
53 | +++ b/chromium/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc | ||
54 | @@ -148,7 +148,14 @@ ResultExpr EvaluateSyscallImpl(int fs_denied_errno, | ||
55 | return Allow(); | ||
56 | #endif | ||
57 | |||
58 | - if (sysno == __NR_clock_gettime || sysno == __NR_clock_nanosleep) { | ||
59 | + if (sysno == __NR_clock_gettime || sysno == __NR_clock_nanosleep | ||
60 | +#if defined(__NR_clock_gettime64) | ||
61 | + || sysno == __NR_clock_gettime64 | ||
62 | +#endif | ||
63 | +#if defined(__NR_clock_nanosleep_time64) | ||
64 | + || sysno == __NR_clock_nanosleep_time64 | ||
65 | +#endif | ||
66 | + ) { | ||
67 | return RestrictClockID(); | ||
68 | } | ||
69 | |||
70 | diff --git a/chromium/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions_unittests.cc b/chromium/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions_unittests.cc | ||
71 | index 76193b62c9f..7731c697002 100644 | ||
72 | --- a/chromium/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions_unittests.cc | ||
73 | +++ b/chromium/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions_unittests.cc | ||
74 | @@ -60,6 +60,12 @@ class RestrictClockIdPolicy : public bpf_dsl::Policy { | ||
75 | case __NR_clock_gettime: | ||
76 | case __NR_clock_getres: | ||
77 | case __NR_clock_nanosleep: | ||
78 | +#if defined(__NR_clock_nanosleep_time64) | ||
79 | + case __NR_clock_nanosleep_time64: | ||
80 | +#endif | ||
81 | +#if defined(__NR_clock_gettime64) | ||
82 | + case __NR_clock_gettime64: | ||
83 | +#endif | ||
84 | return RestrictClockID(); | ||
85 | default: | ||
86 | return Allow(); | ||
87 | diff --git a/chromium/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc b/chromium/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc | ||
88 | index d9d18822f67..0db8745cb57 100644 | ||
89 | --- a/chromium/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc | ||
90 | +++ b/chromium/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc | ||
91 | @@ -39,6 +39,12 @@ bool SyscallSets::IsAllowedGettime(int sysno) { | ||
92 | // filtered by RestrictClokID(). | ||
93 | case __NR_clock_gettime: // Parameters filtered by RestrictClockID(). | ||
94 | case __NR_clock_nanosleep: // Parameters filtered by RestrictClockID(). | ||
95 | +#if defined(__NR_clock_gettime64) | ||
96 | + case __NR_clock_gettime64: // Parameters filtered by RestrictClockID(). | ||
97 | +#endif | ||
98 | +#if defined(__NR_clock_nanosleep_time64) | ||
99 | + case __NR_clock_nanosleep_time64: // Parameters filtered by RestrictClockID(). | ||
100 | +#endif | ||
101 | case __NR_clock_settime: // Privileged. | ||
102 | #if defined(__i386__) || \ | ||
103 | (defined(ARCH_CPU_MIPS_FAMILY) && defined(ARCH_CPU_32_BITS)) | ||
104 | diff --git a/chromium/sandbox/linux/system_headers/arm_linux_syscalls.h b/chromium/sandbox/linux/system_headers/arm_linux_syscalls.h | ||
105 | index 1addd53843c..5de2162f981 100644 | ||
106 | --- a/chromium/sandbox/linux/system_headers/arm_linux_syscalls.h | ||
107 | +++ b/chromium/sandbox/linux/system_headers/arm_linux_syscalls.h | ||
108 | @@ -1385,6 +1385,14 @@ | ||
109 | #define __NR_memfd_create (__NR_SYSCALL_BASE+385) | ||
110 | #endif | ||
111 | |||
112 | +#if !defined(__NR_clock_gettime64) | ||
113 | +#define __NR_clock_gettime64 (__NR_SYSCALL_BASE+403) | ||
114 | +#endif | ||
115 | + | ||
116 | +#if !defined(__NR_clock_nanosleep_time64) | ||
117 | +#define __NR_clock_nanosleep_time64 (__NR_SYSCALL_BASE+407) | ||
118 | +#endif | ||
119 | + | ||
120 | // ARM private syscalls. | ||
121 | #if !defined(__ARM_NR_BASE) | ||
122 | #define __ARM_NR_BASE (__NR_SYSCALL_BASE + 0xF0000) | ||
123 | diff --git a/chromium/sandbox/linux/system_headers/mips_linux_syscalls.h b/chromium/sandbox/linux/system_headers/mips_linux_syscalls.h | ||
124 | index ddbf97f3d8b..fa01b3bbc66 100644 | ||
125 | --- a/chromium/sandbox/linux/system_headers/mips_linux_syscalls.h | ||
126 | +++ b/chromium/sandbox/linux/system_headers/mips_linux_syscalls.h | ||
127 | @@ -1433,4 +1433,12 @@ | ||
128 | #define __NR_memfd_create (__NR_Linux + 354) | ||
129 | #endif | ||
130 | |||
131 | +#if !defined(__NR_clock_gettime64) | ||
132 | +#define __NR_clock_gettime64 (__NR_Linux + 403) | ||
133 | +#endif | ||
134 | + | ||
135 | +#if !defined(__NR_clock_nanosleep_time64) | ||
136 | +#define __NR_clock_nanosleep_time64 (__NR_Linux + 407) | ||
137 | +#endif | ||
138 | + | ||
139 | #endif // SANDBOX_LINUX_SYSTEM_HEADERS_MIPS_LINUX_SYSCALLS_H_ | ||
diff --git a/recipes-qt/qt5/qtwebengine_git.bb b/recipes-qt/qt5/qtwebengine_git.bb index b49d6cee..c0fa7fbc 100644 --- a/recipes-qt/qt5/qtwebengine_git.bb +++ b/recipes-qt/qt5/qtwebengine_git.bb | |||
@@ -171,6 +171,7 @@ SRC_URI += " \ | |||
171 | file://chromium/0010-chromium-Move-CharAllocator-definition-to-a-header-f.patch;patchdir=src/3rdparty \ | 171 | file://chromium/0010-chromium-Move-CharAllocator-definition-to-a-header-f.patch;patchdir=src/3rdparty \ |
172 | file://chromium/0011-chromium-Include-cstddef-and-cstdint.patch;patchdir=src/3rdparty \ | 172 | file://chromium/0011-chromium-Include-cstddef-and-cstdint.patch;patchdir=src/3rdparty \ |
173 | file://chromium/0012-chromium-Link-v8-with-libatomic-on-x86.patch;patchdir=src/3rdparty \ | 173 | file://chromium/0012-chromium-Link-v8-with-libatomic-on-x86.patch;patchdir=src/3rdparty \ |
174 | file://chromium/0013-chromium-Fix-sandbox-Aw-snap-for-syscalls-403-and-40.patch;patchdir=src/3rdparty \ | ||
174 | " | 175 | " |
175 | 176 | ||
176 | SRC_URI_append_libc-musl = "\ | 177 | SRC_URI_append_libc-musl = "\ |