diff --git a/chromium-glibc-2.33.patch b/chromium-glibc-2.33.patch new file mode 100644 index 0000000..19237ef --- /dev/null +++ b/chromium-glibc-2.33.patch @@ -0,0 +1,150 @@ +# Patch made by Kevin Kofler +# https://bugzilla.redhat.com/show_bug.cgi?id=1904652 + +Index: qtwebengine-everywhere-src-5.15.2/src/3rdparty/chromium/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc +=================================================================== +--- qtwebengine-everywhere-src-5.15.2.orig/src/3rdparty/chromium/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc ++++ qtwebengine-everywhere-src-5.15.2/src/3rdparty/chromium/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc +@@ -253,6 +253,18 @@ ResultExpr EvaluateSyscallImpl(int fs_de + return RestrictKillTarget(current_pid, sysno); + } + ++#if defined(__NR_newfstatat) ++ if (sysno == __NR_newfstatat) { ++ return RewriteFstatatSIGSYS(); ++ } ++#endif ++ ++#if defined(__NR_fstatat64) ++ if (sysno == __NR_fstatat64) { ++ return RewriteFstatatSIGSYS(); ++ } ++#endif ++ + if (SyscallSets::IsFileSystem(sysno) || + SyscallSets::IsCurrentDirectory(sysno)) { + return Error(fs_denied_errno); +Index: qtwebengine-everywhere-src-5.15.2/src/3rdparty/chromium/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc +=================================================================== +--- qtwebengine-everywhere-src-5.15.2.orig/src/3rdparty/chromium/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc ++++ qtwebengine-everywhere-src-5.15.2/src/3rdparty/chromium/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc +@@ -6,6 +6,8 @@ + + #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h" + ++#include ++#include + #include + #include + #include +@@ -353,6 +355,35 @@ intptr_t SIGSYSSchedHandler(const struct + return -ENOSYS; + } + ++intptr_t SIGSYSFstatatHandler(const struct arch_seccomp_data& args, ++ void* aux) { ++ switch (args.nr) { ++#if defined(__NR_newfstatat) ++ case __NR_newfstatat: ++#endif ++#if defined(__NR_fstatat64) ++ case __NR_fstatat64: ++#endif ++#if defined(__NR_newfstatat) || defined(__NR_fstatat64) ++ if (*reinterpret_cast(args.args[1]) == '\0' ++ && args.args[3] == static_cast(AT_EMPTY_PATH)) { ++ return sandbox::sys_fstat64(static_cast(args.args[0]), ++ reinterpret_cast(args.args[2])); ++ } else { ++ errno = EACCES; ++ return -1; ++ } ++ break; ++#endif ++ } ++ ++ CrashSIGSYS_Handler(args, aux); ++ ++ // Should never be reached. ++ RAW_CHECK(false); ++ return -ENOSYS; ++} ++ + bpf_dsl::ResultExpr CrashSIGSYS() { + return bpf_dsl::Trap(CrashSIGSYS_Handler, NULL); + } +@@ -385,6 +416,10 @@ bpf_dsl::ResultExpr RewriteSchedSIGSYS() + return bpf_dsl::Trap(SIGSYSSchedHandler, NULL); + } + ++bpf_dsl::ResultExpr RewriteFstatatSIGSYS() { ++ return bpf_dsl::Trap(SIGSYSFstatatHandler, NULL); ++} ++ + void AllocateCrashKeys() { + #if !defined(OS_NACL_NONSFI) + if (seccomp_crash_key) +Index: qtwebengine-everywhere-src-5.15.2/src/3rdparty/chromium/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h +=================================================================== +--- qtwebengine-everywhere-src-5.15.2.orig/src/3rdparty/chromium/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h ++++ qtwebengine-everywhere-src-5.15.2/src/3rdparty/chromium/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h +@@ -63,6 +63,11 @@ SIGSYSPtraceFailure(const struct arch_se + SANDBOX_EXPORT intptr_t + SIGSYSSchedHandler(const struct arch_seccomp_data& args, void* aux); + ++// If the fstatat syscall is actually a disguised fstat, calls the regular fstat ++// syscall, otherwise, crashes in the same way as CrashSIGSYS_Handler. ++SANDBOX_EXPORT intptr_t SIGSYSFstatatHandler(const struct arch_seccomp_data& args, ++ void* aux); ++ + // Variants of the above functions for use with bpf_dsl. + SANDBOX_EXPORT bpf_dsl::ResultExpr CrashSIGSYS(); + SANDBOX_EXPORT bpf_dsl::ResultExpr CrashSIGSYSClone(); +@@ -72,6 +77,7 @@ SANDBOX_EXPORT bpf_dsl::ResultExpr Crash + SANDBOX_EXPORT bpf_dsl::ResultExpr CrashSIGSYSFutex(); + SANDBOX_EXPORT bpf_dsl::ResultExpr CrashSIGSYSPtrace(); + SANDBOX_EXPORT bpf_dsl::ResultExpr RewriteSchedSIGSYS(); ++SANDBOX_EXPORT bpf_dsl::ResultExpr RewriteFstatatSIGSYS(); + + // Allocates a crash key so that Seccomp information can be recorded. + void AllocateCrashKeys(); +Index: qtwebengine-everywhere-src-5.15.2/src/3rdparty/chromium/sandbox/linux/services/syscall_wrappers.cc +=================================================================== +--- qtwebengine-everywhere-src-5.15.2.orig/src/3rdparty/chromium/sandbox/linux/services/syscall_wrappers.cc ++++ qtwebengine-everywhere-src-5.15.2/src/3rdparty/chromium/sandbox/linux/services/syscall_wrappers.cc +@@ -261,4 +261,13 @@ int sys_sigaction(int signum, + + #endif // defined(MEMORY_SANITIZER) + ++SANDBOX_EXPORT int sys_fstat64(int fd, struct stat64 *buf) ++{ ++#if defined(__NR_fstat64) ++ return syscall(__NR_fstat64, fd, buf); ++#else ++ return syscall(__NR_fstat, fd, buf); ++#endif ++} ++ + } // namespace sandbox +Index: qtwebengine-everywhere-src-5.15.2/src/3rdparty/chromium/sandbox/linux/services/syscall_wrappers.h +=================================================================== +--- qtwebengine-everywhere-src-5.15.2.orig/src/3rdparty/chromium/sandbox/linux/services/syscall_wrappers.h ++++ qtwebengine-everywhere-src-5.15.2/src/3rdparty/chromium/sandbox/linux/services/syscall_wrappers.h +@@ -17,6 +17,7 @@ struct sock_fprog; + struct rlimit64; + struct cap_hdr; + struct cap_data; ++struct stat64; + + namespace sandbox { + +@@ -84,6 +85,9 @@ SANDBOX_EXPORT int sys_sigaction(int sig + const struct sigaction* act, + struct sigaction* oldact); + ++// Recent glibc rewrites fstat to fstatat. ++SANDBOX_EXPORT int sys_fstat64(int fd, struct stat64 *buf); ++ + } // namespace sandbox + + #endif // SANDBOX_LINUX_SERVICES_SYSCALL_WRAPPERS_H_ diff --git a/libqt5-qtwebengine.changes b/libqt5-qtwebengine.changes index 5aae2da..b9cdb23 100644 --- a/libqt5-qtwebengine.changes +++ b/libqt5-qtwebengine.changes @@ -1,3 +1,9 @@ +------------------------------------------------------------------- +Mon Feb 15 16:28:49 UTC 2021 - Fabian Vogt + +- Add patch to fix sandbox with glibc 2.33 (boo#1182233): + * chromium-glibc-2.33.patch + ------------------------------------------------------------------- Fri Jan 29 11:06:22 UTC 2021 - Fabian Vogt diff --git a/libqt5-qtwebengine.spec b/libqt5-qtwebengine.spec index 203f96c..a0725aa 100644 --- a/libqt5-qtwebengine.spec +++ b/libqt5-qtwebengine.spec @@ -51,9 +51,10 @@ URL: https://www.qt.io Source: https://download.qt.io/official_releases/qt/5.15/%{real_version}/submodules/%{tar_version}.tar.xz # PATCH-FIX-UPSTREAM armv6-ffmpeg-no-thumb.patch - Fix ffmpeg configuration for armv6 Patch1: armv6-ffmpeg-no-thumb.patch -# PATCH-FIX-UPSTREAM disable-gpu-when-using-nouveau-boo-1005323.diff +# PATCH-FIX-OPENSUSE disable-gpu-when-using-nouveau-boo-1005323.diff Patch2: disable-gpu-when-using-nouveau-boo-1005323.diff Patch7: fix1163766.patch +Patch8: chromium-glibc-2.33.patch # PATCH-FIX-OPENSUSE Patch9: rtc-dont-use-h264.patch # PATCH-FIX-UPSTREAM