Package: apt Version: 1.6~alpha7 Severity: important Tags: patch apt fails on x32:
# apt update Reading package lists... Done E: Method http has died unexpectedly! E: Sub-process http received signal 31. strace shows lots of stuff along the lines of "strace: syscall_96(...) in unsupported 64-bit mode of process PID=2997". The attached patch has some more reasoning and fixes this. Thanks, -- Colin Watson [[email protected]]
>From 3b88f5d71e1ec850ad9f692a687c66ef1c714897 Mon Sep 17 00:00:00 2001 From: Colin Watson <[email protected]> Date: Thu, 15 Feb 2018 09:22:10 +0000 Subject: [PATCH] Fix seccomp sandbox on x32 On x32, the kernel VDSO that provides clock_gettime and gettimeofday sometimes falls back to the underlying syscall. Unfortunately, it falls back to the x86-64 variant of that syscall (https://bugs.debian.org/850047), so we need to allow those too. --- methods/aptmethod.h | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/methods/aptmethod.h b/methods/aptmethod.h index 3314115..4ca80f0 100644 --- a/methods/aptmethod.h +++ b/methods/aptmethod.h @@ -136,7 +136,6 @@ protected: ALLOW(chown); ALLOW(chown32); ALLOW(clock_getres); - ALLOW(clock_gettime); ALLOW(clock_nanosleep); ALLOW(close); ALLOW(creat); @@ -188,7 +187,6 @@ protected: ALLOW(get_robust_list); ALLOW(getrusage); ALLOW(gettid); - ALLOW(gettimeofday); ALLOW(getuid); ALLOW(getuid32); ALLOW(ioctl); @@ -310,6 +308,19 @@ protected: return _error->FatalE("aptMethod::Configuration", "Cannot allow %s: %s", custom.c_str(), strerror(-rc)); } + // On x32, the clock_gettime and gettimeofday syscalls fall back to + // the x86-64 syscall in some circumstances + // (https://bugs.debian.org/850047). Note that these must be the last + // syscalls added to the filter, as once we've called seccomp_arch_add + // all syscalls after that point will be allowed for both + // architectures. +#if defined(__x86_64__) && defined(__ILP32__) + if ((rc = seccomp_arch_add(ctx, SCMP_ARCH_X86_64))) + return _error->FatalE("HttpMethod::Configuration", "Cannot add x86-64 architecture: %s", strerror(-rc)); +#endif + ALLOW(clock_gettime); + ALLOW(gettimeofday); + #undef ALLOW rc = seccomp_load(ctx); -- 2.7.4
