snailed
/
void-packages
2
0
Fork 0
Code Issues 1 Pull Requests 2 Actions Activity
void-packages/srcpkgs/firefox/patches/fix-seccomp-musl.patch

185 lines
7.2 KiB
Diff
Raw Blame History

# HG changeset patch
# User Jed Davis <jld@mozilla.com>
# Date 1499804607 21600
# Node ID a8f06d32af317f7db813252afbaae05a13d8863a
# Parent 5cac7af6804c46f6e74547a0fed3c1cb27abc134
Bug 1376653 - Loosen restrictions on clone flags for musl. r=gcp
I've made this non-ifdef'ed, and removed currently unused ifdef'ed cases
for old Android versions, because I'd rather have less code that we're
not even compile-testing than save a few cycles on a non-critical path.
MozReview-Commit-ID: B4Wn1elyK4f
diff --git security/sandbox/linux/SandboxFilter.cpp security/sandbox/linux/SandboxFilter.cpp
--- security/sandbox/linux/SandboxFilter.cpp
+++ security/sandbox/linux/SandboxFilter.cpp
@@ -120,35 +120,29 @@ public:
virtual ResultExpr ClonePolicy(ResultExpr failPolicy) const {
// Allow use for simple thread creation (pthread_create) only.
// WARNING: s390 and cris pass the flags in the second arg -- see
// CLONE_BACKWARDS2 in arch/Kconfig in the kernel source -- but we
// don't support seccomp-bpf on those archs yet.
Arg<int> flags(0);
- // The glibc source hasn't changed the thread creation clone flags
- // since 2004, so this *should* be safe to hard-code. Bionic's
- // value has changed a few times, and has converged on the same one
- // as glibc; allow any of them.
- static const int flags_common = CLONE_VM | CLONE_FS | CLONE_FILES |
- CLONE_SIGHAND | CLONE_THREAD | CLONE_SYSVSEM;
- static const int flags_modern = flags_common | CLONE_SETTLS |
+ // The exact flags used can vary. CLONE_DETACHED is used by musl
+ // and by old versions of Android (<= JB 4.2), but it's been
+ // ignored by the kernel since the beginning of the Git history.
+ //
+ // If we ever need to support Android <= KK 4.4 again, SETTLS
+ // and the *TID flags will need to be made optional.
+ static const int flags_required = CLONE_VM | CLONE_FS | CLONE_FILES |
+ CLONE_SIGHAND | CLONE_THREAD | CLONE_SYSVSEM | CLONE_SETTLS |
CLONE_PARENT_SETTID | CLONE_CHILD_CLEARTID;
+ static const int flags_optional = CLONE_DETACHED;
- // Can't use CASES here because its decltype magic infers const
- // int instead of regular int and bizarre voluminous errors issue
- // forth from the depths of the standard library implementation.
- return Switch(flags)
-#ifdef ANDROID
- .Case(flags_common | CLONE_DETACHED, Allow()) // <= JB 4.2
- .Case(flags_common, Allow()) // JB 4.3 or KK 4.4
-#endif
- .Case(flags_modern, Allow()) // Android L or glibc
- .Default(failPolicy);
+ return If((flags & ~flags_optional) == flags_required, Allow())
+ .Else(failPolicy);
}
virtual ResultExpr PrctlPolicy() const {
// Note: this will probably need PR_SET_VMA if/when it's used on
// Android without being overridden by an allow-all policy, and
// the constant will need to be defined locally.
Arg<int> op(0);
return Switch(op)
# HG changeset patch
# User Jed Davis <jld@mozilla.com>
# Date 1499813988 21600
# Node ID 9b5bb669d1283995fd8d01fe779bd8646cb2cd92
# Parent a8f06d32af317f7db813252afbaae05a13d8863a
Bug 1376653 - Unconditionalize the tkill() polyfill. r=gcp
MozReview-Commit-ID: JzLWCRQ9Keg
diff --git security/sandbox/linux/SandboxFilter.cpp security/sandbox/linux/SandboxFilter.cpp
--- security/sandbox/linux/SandboxFilter.cpp
+++ security/sandbox/linux/SandboxFilter.cpp
@@ -87,25 +87,24 @@ protected:
typedef const sandbox::arch_seccomp_data& ArgsRef;
static intptr_t BlockedSyscallTrap(ArgsRef aArgs, void *aux) {
MOZ_ASSERT(!aux);
return -ENOSYS;
}
private:
-#if defined(ANDROID) && ANDROID_VERSION < 16
// Bug 1093893: Translate tkill to tgkill for pthread_kill; fixed in
// bionic commit 10c8ce59a (in JB and up; API level 16 = Android 4.1).
+ // Bug 1376653: musl also needs this, and security-wise it's harmless.
static intptr_t TKillCompatTrap(const sandbox::arch_seccomp_data& aArgs,
void *aux)
{
return syscall(__NR_tgkill, getpid(), aArgs.args[0], aArgs.args[1]);
}
-#endif
static intptr_t SetNoNewPrivsTrap(ArgsRef& aArgs, void* aux) {
if (gSetSandboxFilter == nullptr) {
// Called after BroadcastSetThreadSandbox finished, therefore
// not our doing and not expected.
return BlockedSyscallTrap(aArgs, nullptr);
}
// Signal that the filter is already in place.
@@ -236,21 +235,19 @@ public:
// Send signals within the process (raise(), profiling, etc.)
case __NR_tgkill: {
Arg<pid_t> tgid(0);
return If(tgid == getpid(), Allow())
.Else(InvalidSyscall());
}
-#if defined(ANDROID) && ANDROID_VERSION < 16
// Polyfill with tgkill; see above.
case __NR_tkill:
return Trap(TKillCompatTrap, nullptr);
-#endif
// Yield
case __NR_sched_yield:
return Allow();
// Thread creation.
case __NR_clone:
return ClonePolicy(InvalidSyscall());
# HG changeset patch
# User Jed Davis <jld@mozilla.com>
# Date 1499814186 21600
# Node ID f68747fe8a15bc355f6380b760d747d52a9f4d26
# Parent 9b5bb669d1283995fd8d01fe779bd8646cb2cd92
Bug 1376653 - Fix handling of architecture differences for getdents. r=gcp
MozReview-Commit-ID: ArGStWwkJAg
diff --git security/sandbox/linux/SandboxFilterUtil.h security/sandbox/linux/SandboxFilterUtil.h
--- security/sandbox/linux/SandboxFilterUtil.h
+++ security/sandbox/linux/SandboxFilterUtil.h
@@ -100,34 +100,38 @@ public:
#ifdef __NR_stat64
#define CASES_FOR_stat case __NR_stat64
#define CASES_FOR_lstat case __NR_lstat64
#define CASES_FOR_fstat case __NR_fstat64
#define CASES_FOR_fstatat case __NR_fstatat64
#define CASES_FOR_statfs case __NR_statfs64: case __NR_statfs
#define CASES_FOR_fstatfs case __NR_fstatfs64: case __NR_fstatfs
#define CASES_FOR_fcntl case __NR_fcntl64
-// We're using the 32-bit version on 32-bit desktop for some reason.
-#define CASES_FOR_getdents case __NR_getdents64: case __NR_getdents
// FIXME: we might not need the compat cases for these on non-Android:
#define CASES_FOR_lseek case __NR_lseek: case __NR__llseek
#define CASES_FOR_ftruncate case __NR_ftruncate: case __NR_ftruncate64
#else
#define CASES_FOR_stat case __NR_stat
#define CASES_FOR_lstat case __NR_lstat
#define CASES_FOR_fstatat case __NR_newfstatat
#define CASES_FOR_fstat case __NR_fstat
#define CASES_FOR_fstatfs case __NR_fstatfs
#define CASES_FOR_statfs case __NR_statfs
#define CASES_FOR_fcntl case __NR_fcntl
-#define CASES_FOR_getdents case __NR_getdents
#define CASES_FOR_lseek case __NR_lseek
#define CASES_FOR_ftruncate case __NR_ftruncate
#endif
+// getdents is not like the other FS-related syscalls with a "64" variant
+#ifdef __NR_getdents
+#define CASES_FOR_getdents case __NR_getdents64: case __NR_getdents
+#else
+#define CASES_FOR_getdents case __NR_getdents64
+#endif
+
#ifdef __NR_sigprocmask
#define CASES_FOR_sigprocmask case __NR_sigprocmask: case __NR_rt_sigprocmask
#define CASES_FOR_sigaction case __NR_sigaction: case __NR_rt_sigaction
#define CASES_FOR_sigreturn case __NR_sigreturn: case __NR_rt_sigreturn
#else
#define CASES_FOR_sigprocmask case __NR_rt_sigprocmask
#define CASES_FOR_sigaction case __NR_rt_sigaction
#define CASES_FOR_sigreturn case __NR_rt_sigreturn
Reference in New Issue View Git Blame Copy Permalink