On Thu, 12 Jan 2017 at 13:21:10 +0000, Simon McVittie wrote:
> Building a test version that has all of those.
It seems to have stopped crashing when re-indexing my music, so that's
a good start...
Please see attached.
S
>From 0f620f85304c1caa00d91039e78345e3fa007216 Mon Sep 17 00:00:00 2001
From: Simon McVittie <[email protected]>
Date: Thu, 12 Jan 2017 12:13:08 +0000
Subject: [PATCH 1/4] Disable libmediaart
It makes tracker-extract write to the filesystem (in its cache directory),
which is incompatible with the seccomp sandbox introduced in 1.10.2.
---
debian/changelog | 9 +++++++++
debian/control | 2 --
debian/rules | 2 +-
3 files changed, 10 insertions(+), 3 deletions(-)
diff --git a/debian/changelog b/debian/changelog
index cbc95c578..d20edf733 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+tracker (1.10.3-1.1) UNRELEASED; urgency=medium
+
+ * Non-maintainer upload.
+ * Disable libmediaart. It makes tracker-extract write to the filesystem
+ (in its cache directory), which is incompatible with the seccomp sandbox
+ introduced in 1.10.2.
+
+ -- Simon McVittie <[email protected]> Thu, 12 Jan 2017 12:11:44 +0000
+
tracker (1.10.3-1) unstable; urgency=medium
* Update debian/watch to version 4 and use new "special strings" to
diff --git a/debian/control b/debian/control
index d17e2e76a..31f5f8ae0 100644
--- a/debian/control
+++ b/debian/control
@@ -22,7 +22,6 @@ Build-Depends: debhelper (>= 10),
libflac-dev (>= 1.2.1),
libgtk-3-dev (>= 3.0.0),
libtotem-plparser-dev,
- libmediaart-2.0-dev (>= 1.9.0),
zlib1g-dev,
libexempi-dev (>= 2.1.0),
# evolution-dev (>= 2.32.0),
@@ -148,7 +147,6 @@ Depends: ${shlibs:Depends},
libtracker-miner-1.0-0 (= ${binary:Version}),
libtracker-sparql-1.0-dev,
libglib2.0-dev,
- libmediaart-2.0-dev,
gir1.2-tracker-1.0 (= ${binary:Version})
Suggests: libtracker-miner-doc
Description: tracker data miner library - development files
diff --git a/debian/rules b/debian/rules
index dcd423921..bfc6ea239 100755
--- a/debian/rules
+++ b/debian/rules
@@ -27,7 +27,7 @@ override_dh_auto_configure:
--enable-nautilus-extension \
--enable-libiptcdata \
--enable-exempi \
- --enable-libmediaart \
+ --disable-libmediaart \
--enable-libexif \
--enable-libgif \
--enable-libjpeg \
--
2.11.0
>From bdec91dbb9183300cff6a0b8182f5d7f76af76ca Mon Sep 17 00:00:00 2001
From: Simon McVittie <[email protected]>
Date: Thu, 12 Jan 2017 12:18:09 +0000
Subject: [PATCH 2/4] Add patches from upstream to make the sandbox allow more
harmless syscalls
Debian #848842, Debian #849936, Launchpad #1649035, Launchpad #1649004.
---
debian/changelog | 2 ++
...ommon-Allow-querying-process-stats-limits.patch | 26 ++++++++++++++
...cker-common-Handle-mlock-munlock-syscalls.patch | 38 ++++++++++++++++++++
...libtracker-common-Whitelist-dup-dup2-dup3.patch | 41 ++++++++++++++++++++++
...ker-common-Whitelist-gettimeofday-syscall.patch | 22 ++++++++++++
.../libtracker-common-Whitelist-umask.patch | 24 +++++++++++++
debian/patches/series | 5 +++
7 files changed, 158 insertions(+)
create mode 100644 debian/patches/libtracker-common-Allow-querying-process-stats-limits.patch
create mode 100644 debian/patches/libtracker-common-Handle-mlock-munlock-syscalls.patch
create mode 100644 debian/patches/libtracker-common-Whitelist-dup-dup2-dup3.patch
create mode 100644 debian/patches/libtracker-common-Whitelist-gettimeofday-syscall.patch
create mode 100644 debian/patches/libtracker-common-Whitelist-umask.patch
diff --git a/debian/changelog b/debian/changelog
index d20edf733..e999c4aa2 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -4,6 +4,8 @@ tracker (1.10.3-1.1) UNRELEASED; urgency=medium
* Disable libmediaart. It makes tracker-extract write to the filesystem
(in its cache directory), which is incompatible with the seccomp sandbox
introduced in 1.10.2.
+ * Add patches from upstream to make the sandbox allow more harmless
+ syscalls (Closes: #848842, #849936, LP: #1649035, LP: #1649004)
-- Simon McVittie <[email protected]> Thu, 12 Jan 2017 12:11:44 +0000
diff --git a/debian/patches/libtracker-common-Allow-querying-process-stats-limits.patch b/debian/patches/libtracker-common-Allow-querying-process-stats-limits.patch
new file mode 100644
index 000000000..4fb55a9d3
--- /dev/null
+++ b/debian/patches/libtracker-common-Allow-querying-process-stats-limits.patch
@@ -0,0 +1,26 @@
+From: Carlos Garnacho <[email protected]>
+Date: Wed, 21 Dec 2016 17:12:22 +0100
+Subject: libtracker-common: Allow querying process stats/limits
+
+Modifying those is not allowed though.
+
+Bug: https://bugzilla.gnome.org/show_bug.cgi?id=776117
+Origin: upstream, 1.11.3, commit:47b4958fcdbf758e4a90ecc06e58e321372bef18
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu-gnome/+bug/1649004
+---
+ src/libtracker-common/tracker-seccomp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/libtracker-common/tracker-seccomp.c b/src/libtracker-common/tracker-seccomp.c
+index 3054e73d6..28fa95fea 100644
+--- a/src/libtracker-common/tracker-seccomp.c
++++ b/src/libtracker-common/tracker-seccomp.c
+@@ -73,6 +73,8 @@ tracker_seccomp_init (void)
+ ALLOW_RULE (getppid);
+ ALLOW_RULE (gettid);
+ ALLOW_RULE (exit);
++ ALLOW_RULE (getrusage);
++ ALLOW_RULE (getrlimit);
+ /* Basic filesystem access */
+ ALLOW_RULE (fstat);
+ ALLOW_RULE (fstat64);
diff --git a/debian/patches/libtracker-common-Handle-mlock-munlock-syscalls.patch b/debian/patches/libtracker-common-Handle-mlock-munlock-syscalls.patch
new file mode 100644
index 000000000..88c9e3b87
--- /dev/null
+++ b/debian/patches/libtracker-common-Handle-mlock-munlock-syscalls.patch
@@ -0,0 +1,38 @@
+From: Carlos Garnacho <[email protected]>
+Date: Wed, 21 Dec 2016 17:02:51 +0100
+Subject: libtracker-common: Handle mlock*/munlock* syscalls
+
+Disallow pinning memory on RAM, but make it softly fail with EPERM.
+
+Bug: https://bugzilla.gnome.org/show_bug.cgi?id=776117
+Origin: upstream, 1.11.3, commit:c9acfe0e3a3ee5b809860845b856a876c7d42eb0
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=848842
+---
+ src/libtracker-common/tracker-seccomp.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/src/libtracker-common/tracker-seccomp.c b/src/libtracker-common/tracker-seccomp.c
+index 2d4cfcdf9..3054e73d6 100644
+--- a/src/libtracker-common/tracker-seccomp.c
++++ b/src/libtracker-common/tracker-seccomp.c
+@@ -40,6 +40,8 @@
+
+ #define ALLOW_RULE(call) G_STMT_START { if (seccomp_rule_add (ctx, SCMP_ACT_ALLOW, SCMP_SYS(call), 0) < 0) goto out; } G_STMT_END
+
++#define ERROR_RULE(call, error) G_STMT_START { if (seccomp_rule_add (ctx, SCMP_ACT_ERRNO (error), SCMP_SYS(call), 0) < 0) goto out; } G_STMT_END
++
+ gboolean
+ tracker_seccomp_init (void)
+ {
+@@ -57,6 +59,11 @@ tracker_seccomp_init (void)
+ ALLOW_RULE (mremap);
+ ALLOW_RULE (mprotect);
+ ALLOW_RULE (madvise);
++ ERROR_RULE (mlock, EPERM);
++ ERROR_RULE (mlock2, EPERM);
++ ERROR_RULE (munlock, EPERM);
++ ERROR_RULE (mlockall, EPERM);
++ ERROR_RULE (munlockall, EPERM);
+ /* Process management */
+ ALLOW_RULE (exit_group);
+ ALLOW_RULE (getuid);
diff --git a/debian/patches/libtracker-common-Whitelist-dup-dup2-dup3.patch b/debian/patches/libtracker-common-Whitelist-dup-dup2-dup3.patch
new file mode 100644
index 000000000..7338d7b84
--- /dev/null
+++ b/debian/patches/libtracker-common-Whitelist-dup-dup2-dup3.patch
@@ -0,0 +1,41 @@
+From: Carlos Garnacho <[email protected]>
+Date: Sat, 17 Dec 2016 15:45:21 +0100
+Subject: libtracker-common: Whitelist dup/dup2/dup3
+
+dup2/3 have special requirements, as they can close underlying
+fds, they are not allowed on stdin/out/err.
+
+Origin: upstream, 1.11.3, commit:435eca3325d2e27183de2e12c3d4cc840e362fb1
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=849936
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu-gnome/+bug/1649035
+---
+ src/libtracker-common/tracker-seccomp.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/src/libtracker-common/tracker-seccomp.c b/src/libtracker-common/tracker-seccomp.c
+index 9906a6a54..81ddb0959 100644
+--- a/src/libtracker-common/tracker-seccomp.c
++++ b/src/libtracker-common/tracker-seccomp.c
+@@ -118,6 +118,7 @@ tracker_seccomp_init (void)
+ ALLOW_RULE (fadvise64);
+ ALLOW_RULE (write);
+ ALLOW_RULE (writev);
++ ALLOW_RULE (dup);
+ /* Needed by some GStreamer modules doing crazy stuff, less
+ * scary thanks to the restriction below about sockets being
+ * local.
+@@ -168,6 +169,14 @@ tracker_seccomp_init (void)
+ SCMP_CMP(1, SCMP_CMP_MASKED_EQ, O_RDWR, O_RDWR)) < 0)
+ goto out;
+
++ /* Special requirements for dup2/dup3, no fiddling with stdin/out/err */
++ if (seccomp_rule_add (ctx, SCMP_ACT_ALLOW, SCMP_SYS(dup2), 1,
++ SCMP_CMP(1, SCMP_CMP_GT, 2)) < 0)
++ goto out;
++ if (seccomp_rule_add (ctx, SCMP_ACT_ALLOW, SCMP_SYS(dup3), 1,
++ SCMP_CMP(1, SCMP_CMP_GT, 2)) < 0)
++ goto out;
++
+ g_debug ("Loading seccomp rules.");
+
+ if (seccomp_load (ctx) >= 0)
diff --git a/debian/patches/libtracker-common-Whitelist-gettimeofday-syscall.patch b/debian/patches/libtracker-common-Whitelist-gettimeofday-syscall.patch
new file mode 100644
index 000000000..f9a9cbc64
--- /dev/null
+++ b/debian/patches/libtracker-common-Whitelist-gettimeofday-syscall.patch
@@ -0,0 +1,22 @@
+From: Carlos Garnacho <[email protected]>
+Date: Sat, 17 Dec 2016 00:40:00 +0100
+Subject: libtracker-common: Whitelist gettimeofday() syscall
+
+Bug: https://bugzilla.gnome.org/show_bug.cgi?id=776117
+Origin: upstream, 1.10.4, commit:38e6ef17a537f3a9b24997b8f2fc8315f625528a
+---
+ src/libtracker-common/tracker-seccomp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/libtracker-common/tracker-seccomp.c b/src/libtracker-common/tracker-seccomp.c
+index cf5dac6bb..9906a6a54 100644
+--- a/src/libtracker-common/tracker-seccomp.c
++++ b/src/libtracker-common/tracker-seccomp.c
+@@ -108,6 +108,7 @@ tracker_seccomp_init (void)
+ ALLOW_RULE (getrandom);
+ ALLOW_RULE (clock_gettime);
+ ALLOW_RULE (clock_getres);
++ ALLOW_RULE (gettimeofday);
+ /* Descriptors */
+ ALLOW_RULE (close);
+ ALLOW_RULE (read);
diff --git a/debian/patches/libtracker-common-Whitelist-umask.patch b/debian/patches/libtracker-common-Whitelist-umask.patch
new file mode 100644
index 000000000..a391cda82
--- /dev/null
+++ b/debian/patches/libtracker-common-Whitelist-umask.patch
@@ -0,0 +1,24 @@
+From: Carlos Garnacho <[email protected]>
+Date: Sat, 17 Dec 2016 15:46:19 +0100
+Subject: libtracker-common: Whitelist umask
+
+Let's give extractor modules the illusion that they can write
+something, they actually can't.
+
+Origin: upstream, 1.11.3, commit:73f5cd54a2e8b4ea8fbb4b3997b24d5e4aebd671
+---
+ src/libtracker-common/tracker-seccomp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/libtracker-common/tracker-seccomp.c b/src/libtracker-common/tracker-seccomp.c
+index 81ddb0959..2d4cfcdf9 100644
+--- a/src/libtracker-common/tracker-seccomp.c
++++ b/src/libtracker-common/tracker-seccomp.c
+@@ -83,6 +83,7 @@ tracker_seccomp_init (void)
+ ALLOW_RULE (utime);
+ ALLOW_RULE (time);
+ ALLOW_RULE (fsync);
++ ALLOW_RULE (umask);
+ /* Processes and threads */
+ ALLOW_RULE (clone);
+ ALLOW_RULE (futex);
diff --git a/debian/patches/series b/debian/patches/series
index e69de29bb..99e36a328 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -0,0 +1,5 @@
+libtracker-common-Whitelist-gettimeofday-syscall.patch
+libtracker-common-Whitelist-dup-dup2-dup3.patch
+libtracker-common-Whitelist-umask.patch
+libtracker-common-Handle-mlock-munlock-syscalls.patch
+libtracker-common-Allow-querying-process-stats-limits.patch
--
2.11.0
