|
 |
aacff36 |
From b3a14db7637232d30c878cc1f1ad6d8037e81379 Mon Sep 17 00:00:00 2001
|
|
|
aacff36 |
From: Shawn Anastasio <shawn@anastas.io>
|
|
|
aacff36 |
Date: Tue, 15 Jan 2019 22:42:21 -0600
|
|
|
aacff36 |
Subject: [PATCH] linux/seccomp-bpf: ppc64+glibc workaround in SIGSYS handler
|
|
|
aacff36 |
|
|
|
aacff36 |
Workaround for an apparent issue with glibc negating syscall
|
|
|
aacff36 |
parameters. Observed on a ppc64le machine with glibc.
|
|
|
aacff36 |
More investigation required.
|
|
|
aacff36 |
---
|
|
|
aacff36 |
sandbox/linux/seccomp-bpf/trap.cc | 14 ++++++++++++++
|
|
|
aacff36 |
1 file changed, 14 insertions(+)
|
|
|
aacff36 |
|
|
|
aacff36 |
Index: chromium-120.0.6099.71/sandbox/linux/seccomp-bpf/trap.cc
|
|
|
aacff36 |
===================================================================
|
|
|
aacff36 |
--- chromium-120.0.6099.71.orig/sandbox/linux/seccomp-bpf/trap.cc
|
|
|
aacff36 |
+++ chromium-120.0.6099.71/sandbox/linux/seccomp-bpf/trap.cc
|
|
|
aacff36 |
@@ -232,6 +232,20 @@ void Trap::SigSys(int nr, LinuxSigInfo*
|
|
|
aacff36 |
SetIsInSigHandler();
|
|
|
aacff36 |
}
|
|
|
aacff36 |
|
|
|
aacff36 |
+#if defined(__powerpc64__)
|
|
|
aacff36 |
+ // On ppc64+glibc, some syscalls seem to accidentally negate the first
|
|
|
aacff36 |
+ // parameter which causes checks against it to fail. For now, manually
|
|
|
aacff36 |
+ // negate them back.
|
|
|
aacff36 |
+ // TODO(shawn@anastas.io): investigate this issue further
|
|
|
aacff36 |
+ auto nr = SECCOMP_SYSCALL(ctx);
|
|
|
aacff36 |
+ if (nr == __NR_openat || nr == __NR_mkdirat || nr == __NR_faccessat || nr == __NR_readlinkat ||
|
|
|
aacff36 |
+ nr == __NR_renameat || nr == __NR_renameat2 || nr == __NR_newfstatat || nr == __NR_unlinkat) {
|
|
|
aacff36 |
+ if (static_cast<int>(SECCOMP_PARM1(ctx)) > 0) {
|
|
|
aacff36 |
+ SECCOMP_PARM1(ctx) = -SECCOMP_PARM1(ctx);
|
|
|
aacff36 |
+ }
|
|
|
aacff36 |
+ }
|
|
|
aacff36 |
+#endif
|
|
|
aacff36 |
+
|
|
|
aacff36 |
// Copy the seccomp-specific data into a arch_seccomp_data structure. This
|
|
|
aacff36 |
// is what we are showing to TrapFnc callbacks that the system call
|
|
|
aacff36 |
// evaluator registered with the sandbox.
|