Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE
chromium.15805
chromium-glibc-2.33.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File chromium-glibc-2.33.patch of Package chromium.15805
# Patch made by Kevin Kofler <Kevin@tigcc.ticalc.org> # https://bugzilla.redhat.com/show_bug.cgi?id=1904652 diff -up chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc.fstatfix chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc --- chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc.fstatfix 2021-01-25 10:11:45.427436398 -0500 +++ chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc 2021-01-25 10:12:51.337699003 -0500 @@ -257,6 +257,18 @@ ResultExpr EvaluateSyscallImpl(int fs_de return RestrictKillTarget(current_pid, sysno); } +#if defined(__NR_newfstatat) + if (sysno == __NR_newfstatat) { + return RewriteFstatatSIGSYS(); + } +#endif + +#if defined(__NR_fstatat64) + if (sysno == __NR_fstatat64) { + return RewriteFstatatSIGSYS(); + } +#endif + if (SyscallSets::IsFileSystem(sysno) || SyscallSets::IsCurrentDirectory(sysno)) { return Error(fs_denied_errno); diff -up chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc.fstatfix chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc --- chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc.fstatfix 2021-01-25 10:13:10.179774081 -0500 +++ chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc 2021-01-25 10:16:18.790525746 -0500 @@ -6,6 +6,8 @@ #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h" +#include <errno.h> +#include <fcntl.h> #include <stddef.h> #include <stdint.h> #include <string.h> @@ -355,6 +357,35 @@ intptr_t SIGSYSSchedHandler(const struct return -ENOSYS; } +intptr_t SIGSYSFstatatHandler(const struct arch_seccomp_data& args, + void* aux) { + switch (args.nr) { +#if defined(__NR_newfstatat) + case __NR_newfstatat: +#endif +#if defined(__NR_fstatat64) + case __NR_fstatat64: +#endif +#if defined(__NR_newfstatat) || defined(__NR_fstatat64) + if (*reinterpret_cast<const char *>(args.args[1]) == '\0' + && args.args[3] == static_cast<uint64_t>(AT_EMPTY_PATH)) { + return sandbox::sys_fstat64(static_cast<int>(args.args[0]), + reinterpret_cast<struct stat64 *>(args.args[2])); + } else { + errno = EACCES; + return -1; + } + break; +#endif + } + + CrashSIGSYS_Handler(args, aux); + + // Should never be reached. + RAW_CHECK(false); + return -ENOSYS; +} + bpf_dsl::ResultExpr CrashSIGSYS() { return bpf_dsl::Trap(CrashSIGSYS_Handler, NULL); } @@ -387,6 +418,10 @@ bpf_dsl::ResultExpr RewriteSchedSIGSYS() return bpf_dsl::Trap(SIGSYSSchedHandler, NULL); } +bpf_dsl::ResultExpr RewriteFstatatSIGSYS() { + return bpf_dsl::Trap(SIGSYSFstatatHandler, NULL); +} + void AllocateCrashKeys() { #if !defined(OS_NACL_NONSFI) if (seccomp_crash_key) diff -up chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h.fstatfix chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h --- chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h.fstatfix 2021-01-25 10:16:36.982598236 -0500 +++ chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h 2021-01-25 10:18:45.705111027 -0500 @@ -62,6 +62,10 @@ SANDBOX_EXPORT intptr_t SIGSYSPtraceFail // sched_setparam(), sched_setscheduler() SANDBOX_EXPORT intptr_t SIGSYSSchedHandler(const arch_seccomp_data& args, void* aux); +// If the fstatat syscall is actually a disguised fstat, calls the regular fstat +// syscall, otherwise, crashes in the same way as CrashSIGSYS_Handler. +SANDBOX_EXPORT intptr_t SIGSYSFstatatHandler(const struct arch_seccomp_data& args, + void* aux); // Variants of the above functions for use with bpf_dsl. SANDBOX_EXPORT bpf_dsl::ResultExpr CrashSIGSYS(); @@ -72,6 +76,7 @@ SANDBOX_EXPORT bpf_dsl::ResultExpr Crash SANDBOX_EXPORT bpf_dsl::ResultExpr CrashSIGSYSFutex(); SANDBOX_EXPORT bpf_dsl::ResultExpr CrashSIGSYSPtrace(); SANDBOX_EXPORT bpf_dsl::ResultExpr RewriteSchedSIGSYS(); +SANDBOX_EXPORT bpf_dsl::ResultExpr RewriteFstatatSIGSYS(); // Allocates a crash key so that Seccomp information can be recorded. void AllocateCrashKeys(); diff -up chromium-88.0.4324.96/sandbox/linux/services/syscall_wrappers.cc.fstatfix chromium-88.0.4324.96/sandbox/linux/services/syscall_wrappers.cc --- chromium-88.0.4324.96/sandbox/linux/services/syscall_wrappers.cc.fstatfix 2021-01-25 10:18:53.307141311 -0500 +++ chromium-88.0.4324.96/sandbox/linux/services/syscall_wrappers.cc 2021-01-25 10:19:46.982355293 -0500 @@ -261,4 +261,13 @@ int sys_sigaction(int signum, #endif // defined(MEMORY_SANITIZER) +SANDBOX_EXPORT int sys_fstat64(int fd, struct stat64 *buf) +{ +#if defined(__NR_fstat64) + return syscall(__NR_fstat64, fd, buf); +#else + return syscall(__NR_fstat, fd, buf); +#endif +} + } // namespace sandbox diff -up chromium-88.0.4324.96/sandbox/linux/services/syscall_wrappers.h.fstatfix chromium-88.0.4324.96/sandbox/linux/services/syscall_wrappers.h --- chromium-88.0.4324.96/sandbox/linux/services/syscall_wrappers.h.fstatfix 2021-01-25 10:19:53.115379741 -0500 +++ chromium-88.0.4324.96/sandbox/linux/services/syscall_wrappers.h 2021-01-25 10:20:45.485588421 -0500 @@ -17,6 +17,7 @@ struct sock_fprog; struct rlimit64; struct cap_hdr; struct cap_data; +struct stat64; namespace sandbox { @@ -84,6 +85,9 @@ SANDBOX_EXPORT int sys_sigaction(int sig const struct sigaction* act, struct sigaction* oldact); +// Recent glibc rewrites fstat to fstatat. +SANDBOX_EXPORT int sys_fstat64(int fd, struct stat64 *buf); + } // namespace sandbox #endif // SANDBOX_LINUX_SERVICES_SYSCALL_WRAPPERS_H_
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
