Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package chromium for openSUSE:Factory checked in at 2021-02-15 13:15:42 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/chromium (Old) and /work/SRC/openSUSE:Factory/.chromium.new.28504 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "chromium" Mon Feb 15 13:15:42 2021 rev:283 rq:872345 version:88.0.4324.150 Changes: -------- --- /work/SRC/openSUSE:Factory/chromium/chromium.changes 2021-02-11 12:51:31.493847228 +0100 +++ /work/SRC/openSUSE:Factory/.chromium.new.28504/chromium.changes 2021-02-15 13:15:43.758331261 +0100 @@ -1,0 +2,6 @@ +Mon Feb 15 07:53:24 UTC 2021 - Callum Farmer <[email protected]> + +- Add chromium-glibc-2.33.patch: fix Sandbox with glibc 2.33 + (bsc#1182233) + +------------------------------------------------------------------- New: ---- chromium-glibc-2.33.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ chromium.spec ++++++ --- /var/tmp/diff_new_pack.4c6Mlw/_old 2021-02-15 13:15:48.458338220 +0100 +++ /var/tmp/diff_new_pack.4c6Mlw/_new 2021-02-15 13:15:48.462338225 +0100 @@ -107,6 +107,7 @@ Patch76: chromium-88-StringPool-include.patch Patch77: chromium-88-dawn-static.patch Patch78: chromium-88-CompositorFrameReporter-dcheck.patch +Patch79: chromium-glibc-2.33.patch # Google seem not too keen on merging this but GPU accel is quite important # https://chromium-review.googlesource.com/c/chromium/src/+/532294 # https://github.com/saiarcot895/chromium-ubuntu-build/tree/master/debian/patches ++++++ chromium-glibc-2.33.patch ++++++ # Patch made by Kevin Kofler <[email protected]> # https://bugzilla.redhat.com/show_bug.cgi?id=1904652 diff -up chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc.fstatfix chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc --- chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc.fstatfix 2021-01-25 10:11:45.427436398 -0500 +++ chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc 2021-01-25 10:12:51.337699003 -0500 @@ -257,6 +257,18 @@ ResultExpr EvaluateSyscallImpl(int fs_de return RestrictKillTarget(current_pid, sysno); } +#if defined(__NR_newfstatat) + if (sysno == __NR_newfstatat) { + return RewriteFstatatSIGSYS(); + } +#endif + +#if defined(__NR_fstatat64) + if (sysno == __NR_fstatat64) { + return RewriteFstatatSIGSYS(); + } +#endif + if (SyscallSets::IsFileSystem(sysno) || SyscallSets::IsCurrentDirectory(sysno)) { return Error(fs_denied_errno); diff -up chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc.fstatfix chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc --- chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc.fstatfix 2021-01-25 10:13:10.179774081 -0500 +++ chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc 2021-01-25 10:16:18.790525746 -0500 @@ -6,6 +6,8 @@ #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h" +#include <errno.h> +#include <fcntl.h> #include <stddef.h> #include <stdint.h> #include <string.h> @@ -355,6 +357,35 @@ intptr_t SIGSYSSchedHandler(const struct return -ENOSYS; } +intptr_t SIGSYSFstatatHandler(const struct arch_seccomp_data& args, + void* aux) { + switch (args.nr) { +#if defined(__NR_newfstatat) + case __NR_newfstatat: +#endif +#if defined(__NR_fstatat64) + case __NR_fstatat64: +#endif +#if defined(__NR_newfstatat) || defined(__NR_fstatat64) + if (*reinterpret_cast<const char *>(args.args[1]) == '\0' + && args.args[3] == static_cast<uint64_t>(AT_EMPTY_PATH)) { + return sandbox::sys_fstat64(static_cast<int>(args.args[0]), + reinterpret_cast<struct stat64 *>(args.args[2])); + } else { + errno = EACCES; + return -1; + } + break; +#endif + } + + CrashSIGSYS_Handler(args, aux); + + // Should never be reached. + RAW_CHECK(false); + return -ENOSYS; +} + bpf_dsl::ResultExpr CrashSIGSYS() { return bpf_dsl::Trap(CrashSIGSYS_Handler, NULL); } @@ -387,6 +418,10 @@ bpf_dsl::ResultExpr RewriteSchedSIGSYS() return bpf_dsl::Trap(SIGSYSSchedHandler, NULL); } +bpf_dsl::ResultExpr RewriteFstatatSIGSYS() { + return bpf_dsl::Trap(SIGSYSFstatatHandler, NULL); +} + void AllocateCrashKeys() { #if !defined(OS_NACL_NONSFI) if (seccomp_crash_key) diff -up chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h.fstatfix chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h --- chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h.fstatfix 2021-01-25 10:16:36.982598236 -0500 +++ chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h 2021-01-25 10:18:45.705111027 -0500 @@ -62,6 +62,10 @@ SANDBOX_EXPORT intptr_t SIGSYSPtraceFail // sched_setparam(), sched_setscheduler() SANDBOX_EXPORT intptr_t SIGSYSSchedHandler(const arch_seccomp_data& args, void* aux); +// If the fstatat syscall is actually a disguised fstat, calls the regular fstat +// syscall, otherwise, crashes in the same way as CrashSIGSYS_Handler. +SANDBOX_EXPORT intptr_t SIGSYSFstatatHandler(const struct arch_seccomp_data& args, + void* aux); // Variants of the above functions for use with bpf_dsl. SANDBOX_EXPORT bpf_dsl::ResultExpr CrashSIGSYS(); @@ -72,6 +76,7 @@ SANDBOX_EXPORT bpf_dsl::ResultExpr Crash SANDBOX_EXPORT bpf_dsl::ResultExpr CrashSIGSYSFutex(); SANDBOX_EXPORT bpf_dsl::ResultExpr CrashSIGSYSPtrace(); SANDBOX_EXPORT bpf_dsl::ResultExpr RewriteSchedSIGSYS(); +SANDBOX_EXPORT bpf_dsl::ResultExpr RewriteFstatatSIGSYS(); // Allocates a crash key so that Seccomp information can be recorded. void AllocateCrashKeys(); diff -up chromium-88.0.4324.96/sandbox/linux/services/syscall_wrappers.cc.fstatfix chromium-88.0.4324.96/sandbox/linux/services/syscall_wrappers.cc --- chromium-88.0.4324.96/sandbox/linux/services/syscall_wrappers.cc.fstatfix 2021-01-25 10:18:53.307141311 -0500 +++ chromium-88.0.4324.96/sandbox/linux/services/syscall_wrappers.cc 2021-01-25 10:19:46.982355293 -0500 @@ -261,4 +261,13 @@ int sys_sigaction(int signum, #endif // defined(MEMORY_SANITIZER) +SANDBOX_EXPORT int sys_fstat64(int fd, struct stat64 *buf) +{ +#if defined(__NR_fstat64) + return syscall(__NR_fstat64, fd, buf); +#else + return syscall(__NR_fstat, fd, buf); +#endif +} + } // namespace sandbox diff -up chromium-88.0.4324.96/sandbox/linux/services/syscall_wrappers.h.fstatfix chromium-88.0.4324.96/sandbox/linux/services/syscall_wrappers.h --- chromium-88.0.4324.96/sandbox/linux/services/syscall_wrappers.h.fstatfix 2021-01-25 10:19:53.115379741 -0500 +++ chromium-88.0.4324.96/sandbox/linux/services/syscall_wrappers.h 2021-01-25 10:20:45.485588421 -0500 @@ -17,6 +17,7 @@ struct sock_fprog; struct rlimit64; struct cap_hdr; struct cap_data; +struct stat64; namespace sandbox { @@ -84,6 +85,9 @@ SANDBOX_EXPORT int sys_sigaction(int sig const struct sigaction* act, struct sigaction* oldact); +// Recent glibc rewrites fstat to fstatat. +SANDBOX_EXPORT int sys_fstat64(int fd, struct stat64 *buf); + } // namespace sandbox #endif // SANDBOX_LINUX_SERVICES_SYSCALL_WRAPPERS_H_
