void-packages/srcpkgs/chromium/patches/time64.patch

52 lines
2.1 KiB
Diff

Description: allow sandboxed code to call gettime64
Add __NR_clock_gettime64 and __NR_clock_nanosleep_time64 to syscall whitelist
and clock selection parameter filtering code.
Add __NR_utimensat_time64 to syscall whitelist
Conditionalise additions on the new calls existing, because they do not exist
on 64-bit architectures.
Author: Peter Michael Green <plugwash@raspbian.org>
Index: chromium-83.0.4103.116/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
===================================================================
--- sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
+++ sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
@@ -148,7 +148,11 @@ ResultExpr EvaluateSyscallImpl(int fs_de
return Allow();
#endif
+#ifdef __NR_clock_gettime64
+ if (sysno == __NR_clock_gettime || sysno == __NR_clock_gettime64 || sysno == __NR_clock_nanosleep || sysno == __NR_clock_nanosleep_time64) {
+#else
if (sysno == __NR_clock_gettime || sysno == __NR_clock_nanosleep) {
+#endif
return RestrictClockID();
}
Index: chromium-83.0.4103.116/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc
===================================================================
--- sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc
+++ sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc
@@ -38,6 +38,10 @@ bool SyscallSets::IsAllowedGettime(int s
case __NR_clock_getres: // Allowed only on Android with parameters
// filtered by RestrictClokID().
case __NR_clock_gettime: // Parameters filtered by RestrictClockID().
+#ifdef __NR_clock_gettime64
+ case __NR_clock_gettime64: // Parameters filtered by RestrictClockID().
+ case __NR_clock_nanosleep_time64: // Parameters filtered by RestrictClockID().
+#endif
case __NR_clock_nanosleep: // Parameters filtered by RestrictClockID().
case __NR_clock_settime: // Privileged.
#if defined(__i386__) || \
@@ -159,6 +163,9 @@ bool SyscallSets::IsFileSystem(int sysno
case __NR_utime:
#endif
case __NR_utimensat: // New.
+#ifdef __NR_utimensat_time64
+ case __NR_utimensat_time64:
+#endif
return true;
default:
return false;