forked from pool/libqt5-qtwebengine
Accepting request 872642 from home:Vogtinator:qt5.15
- Add patch to fix sandbox with glibc 2.33 (boo#1182233): * chromium-glibc-2.33.patch OBS-URL: https://build.opensuse.org/request/show/872642 OBS-URL: https://build.opensuse.org/package/show/KDE:Qt:5.15/libqt5-qtwebengine?expand=0&rev=19
This commit is contained in:
Git OBS Bridge
parent
add11f5b64
commit
747eddec88
150
chromium-glibc-2.33.patch
Normal file
150
chromium-glibc-2.33.patch
Normal file
@ -0,0 +1,150 @@
|
||||
# Patch made by Kevin Kofler <Kevin@tigcc.ticalc.org>
|
||||
# https://bugzilla.redhat.com/show_bug.cgi?id=1904652
|
||||
|
||||
Index: qtwebengine-everywhere-src-5.15.2/src/3rdparty/chromium/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
|
||||
===================================================================
|
||||
--- qtwebengine-everywhere-src-5.15.2.orig/src/3rdparty/chromium/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
|
||||
+++ qtwebengine-everywhere-src-5.15.2/src/3rdparty/chromium/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
|
||||
@@ -253,6 +253,18 @@ ResultExpr EvaluateSyscallImpl(int fs_de
|
||||
return RestrictKillTarget(current_pid, sysno);
|
||||
}
|
||||
|
||||
+#if defined(__NR_newfstatat)
|
||||
+ if (sysno == __NR_newfstatat) {
|
||||
+ return RewriteFstatatSIGSYS();
|
||||
+ }
|
||||
+#endif
|
||||
+
|
||||
+#if defined(__NR_fstatat64)
|
||||
+ if (sysno == __NR_fstatat64) {
|
||||
+ return RewriteFstatatSIGSYS();
|
||||
+ }
|
||||
+#endif
|
||||
+
|
||||
if (SyscallSets::IsFileSystem(sysno) ||
|
||||
SyscallSets::IsCurrentDirectory(sysno)) {
|
||||
return Error(fs_denied_errno);
|
||||
Index: qtwebengine-everywhere-src-5.15.2/src/3rdparty/chromium/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc
|
||||
===================================================================
|
||||
--- qtwebengine-everywhere-src-5.15.2.orig/src/3rdparty/chromium/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc
|
||||
+++ qtwebengine-everywhere-src-5.15.2/src/3rdparty/chromium/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc
|
||||
@@ -6,6 +6,8 @@
|
||||
|
||||
#include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h"
|
||||
|
||||
+#include <errno.h>
|
||||
+#include <fcntl.h>
|
||||
#include <stddef.h>
|
||||
#include <stdint.h>
|
||||
#include <sys/syscall.h>
|
||||
@@ -353,6 +355,35 @@ intptr_t SIGSYSSchedHandler(const struct
|
||||
return -ENOSYS;
|
||||
}
|
||||
|
||||
+intptr_t SIGSYSFstatatHandler(const struct arch_seccomp_data& args,
|
||||
+ void* aux) {
|
||||
+ switch (args.nr) {
|
||||
+#if defined(__NR_newfstatat)
|
||||
+ case __NR_newfstatat:
|
||||
+#endif
|
||||
+#if defined(__NR_fstatat64)
|
||||
+ case __NR_fstatat64:
|
||||
+#endif
|
||||
+#if defined(__NR_newfstatat) || defined(__NR_fstatat64)
|
||||
+ if (*reinterpret_cast<const char *>(args.args[1]) == '\0'
|
||||
+ && args.args[3] == static_cast<uint64_t>(AT_EMPTY_PATH)) {
|
||||
+ return sandbox::sys_fstat64(static_cast<int>(args.args[0]),
|
||||
+ reinterpret_cast<struct stat64 *>(args.args[2]));
|
||||
+ } else {
|
||||
+ errno = EACCES;
|
||||
+ return -1;
|
||||
+ }
|
||||
+ break;
|
||||
+#endif
|
||||
+ }
|
||||
+
|
||||
+ CrashSIGSYS_Handler(args, aux);
|
||||
+
|
||||
+ // Should never be reached.
|
||||
+ RAW_CHECK(false);
|
||||
+ return -ENOSYS;
|
||||
+}
|
||||
+
|
||||
bpf_dsl::ResultExpr CrashSIGSYS() {
|
||||
return bpf_dsl::Trap(CrashSIGSYS_Handler, NULL);
|
||||
}
|
||||
@@ -385,6 +416,10 @@ bpf_dsl::ResultExpr RewriteSchedSIGSYS()
|
||||
return bpf_dsl::Trap(SIGSYSSchedHandler, NULL);
|
||||
}
|
||||
|
||||
+bpf_dsl::ResultExpr RewriteFstatatSIGSYS() {
|
||||
+ return bpf_dsl::Trap(SIGSYSFstatatHandler, NULL);
|
||||
+}
|
||||
+
|
||||
void AllocateCrashKeys() {
|
||||
#if !defined(OS_NACL_NONSFI)
|
||||
if (seccomp_crash_key)
|
||||
Index: qtwebengine-everywhere-src-5.15.2/src/3rdparty/chromium/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h
|
||||
===================================================================
|
||||
--- qtwebengine-everywhere-src-5.15.2.orig/src/3rdparty/chromium/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h
|
||||
+++ qtwebengine-everywhere-src-5.15.2/src/3rdparty/chromium/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h
|
||||
@@ -63,6 +63,11 @@ SIGSYSPtraceFailure(const struct arch_se
|
||||
SANDBOX_EXPORT intptr_t
|
||||
SIGSYSSchedHandler(const struct arch_seccomp_data& args, void* aux);
|
||||
|
||||
+// If the fstatat syscall is actually a disguised fstat, calls the regular fstat
|
||||
+// syscall, otherwise, crashes in the same way as CrashSIGSYS_Handler.
|
||||
+SANDBOX_EXPORT intptr_t SIGSYSFstatatHandler(const struct arch_seccomp_data& args,
|
||||
+ void* aux);
|
||||
+
|
||||
// Variants of the above functions for use with bpf_dsl.
|
||||
SANDBOX_EXPORT bpf_dsl::ResultExpr CrashSIGSYS();
|
||||
SANDBOX_EXPORT bpf_dsl::ResultExpr CrashSIGSYSClone();
|
||||
@@ -72,6 +77,7 @@ SANDBOX_EXPORT bpf_dsl::ResultExpr Crash
|
||||
SANDBOX_EXPORT bpf_dsl::ResultExpr CrashSIGSYSFutex();
|
||||
SANDBOX_EXPORT bpf_dsl::ResultExpr CrashSIGSYSPtrace();
|
||||
SANDBOX_EXPORT bpf_dsl::ResultExpr RewriteSchedSIGSYS();
|
||||
+SANDBOX_EXPORT bpf_dsl::ResultExpr RewriteFstatatSIGSYS();
|
||||
|
||||
// Allocates a crash key so that Seccomp information can be recorded.
|
||||
void AllocateCrashKeys();
|
||||
Index: qtwebengine-everywhere-src-5.15.2/src/3rdparty/chromium/sandbox/linux/services/syscall_wrappers.cc
|
||||
===================================================================
|
||||
--- qtwebengine-everywhere-src-5.15.2.orig/src/3rdparty/chromium/sandbox/linux/services/syscall_wrappers.cc
|
||||
+++ qtwebengine-everywhere-src-5.15.2/src/3rdparty/chromium/sandbox/linux/services/syscall_wrappers.cc
|
||||
@@ -261,4 +261,13 @@ int sys_sigaction(int signum,
|
||||
|
||||
#endif // defined(MEMORY_SANITIZER)
|
||||
|
||||
+SANDBOX_EXPORT int sys_fstat64(int fd, struct stat64 *buf)
|
||||
+{
|
||||
+#if defined(__NR_fstat64)
|
||||
+ return syscall(__NR_fstat64, fd, buf);
|
||||
+#else
|
||||
+ return syscall(__NR_fstat, fd, buf);
|
||||
+#endif
|
||||
+}
|
||||
+
|
||||
} // namespace sandbox
|
||||
Index: qtwebengine-everywhere-src-5.15.2/src/3rdparty/chromium/sandbox/linux/services/syscall_wrappers.h
|
||||
===================================================================
|
||||
--- qtwebengine-everywhere-src-5.15.2.orig/src/3rdparty/chromium/sandbox/linux/services/syscall_wrappers.h
|
||||
+++ qtwebengine-everywhere-src-5.15.2/src/3rdparty/chromium/sandbox/linux/services/syscall_wrappers.h
|
||||
@@ -17,6 +17,7 @@ struct sock_fprog;
|
||||
struct rlimit64;
|
||||
struct cap_hdr;
|
||||
struct cap_data;
|
||||
+struct stat64;
|
||||
|
||||
namespace sandbox {
|
||||
|
||||
@@ -84,6 +85,9 @@ SANDBOX_EXPORT int sys_sigaction(int sig
|
||||
const struct sigaction* act,
|
||||
struct sigaction* oldact);
|
||||
|
||||
+// Recent glibc rewrites fstat to fstatat.
|
||||
+SANDBOX_EXPORT int sys_fstat64(int fd, struct stat64 *buf);
|
||||
+
|
||||
} // namespace sandbox
|
||||
|
||||
#endif // SANDBOX_LINUX_SERVICES_SYSCALL_WRAPPERS_H_
|
||||
@ -1,3 +1,9 @@
|
||||
-------------------------------------------------------------------
|
||||
Mon Feb 15 16:28:49 UTC 2021 - Fabian Vogt <fabian@ritter-vogt.de>
|
||||
|
||||
- Add patch to fix sandbox with glibc 2.33 (boo#1182233):
|
||||
* chromium-glibc-2.33.patch
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Fri Jan 29 11:06:22 UTC 2021 - Fabian Vogt <fabian@ritter-vogt.de>
|
||||
|
||||
|
||||
@ -51,9 +51,10 @@ URL: https://www.qt.io
|
||||
Source: https://download.qt.io/official_releases/qt/5.15/%{real_version}/submodules/%{tar_version}.tar.xz
|
||||
# PATCH-FIX-UPSTREAM armv6-ffmpeg-no-thumb.patch - Fix ffmpeg configuration for armv6
|
||||
Patch1: armv6-ffmpeg-no-thumb.patch
|
||||
# PATCH-FIX-UPSTREAM disable-gpu-when-using-nouveau-boo-1005323.diff
|
||||
# PATCH-FIX-OPENSUSE disable-gpu-when-using-nouveau-boo-1005323.diff
|
||||
Patch2: disable-gpu-when-using-nouveau-boo-1005323.diff
|
||||
Patch7: fix1163766.patch
|
||||
Patch8: chromium-glibc-2.33.patch
|
||||
# PATCH-FIX-OPENSUSE
|
||||
Patch9: rtc-dont-use-h264.patch
|
||||
# PATCH-FIX-UPSTREAM
|
||||
|
||||
Loading…
Reference in New Issue
Block a user