Bug 1976893

Summary:	chromium: Please make sure that sandbox does not return EPERM for clone3
Product:	[Fedora] Fedora	Reporter:	Florian Weimer <fweimer>
Component:	chromium	Assignee:	Tom "spot" Callaway <spotrh>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	35	CC:	mikhail.v.gavrilov, rdieter, spotrh, tpopela, valdis.kletnieks, yaneti
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	chromium-93.0.4577.63-1.fc34 chromium-93.0.4577.63-1.fc33 chromium-93.0.4577.63-1.fc35	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-09-13 03:42:28 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Florian Weimer 2021-06-28 13:35:43 UTC

clone3 should either fail with ENOSYS (hidding the system call) or succeed. glibc will soon start using clone3 for Tigerlake hardware enablement (but the change will happen on all architectures for consistency). Thanks.

Comment 1 Tom "spot" Callaway 2021-07-01 20:02:18 UTC

I don't think it will fail with EPERM, but I guess we'll find out. The sandboxing code is a bit confusing to me.

Comment 2 Florian Weimer 2021-07-25 21:50:38 UTC

*** Bug 1985800 has been marked as a duplicate of this bug. ***

Comment 3 Valdis Kletnieks 2021-07-26 12:29:44 UTC

Well, I just got bit by the glibc starting using it as per bug #1985800, and it isn't throwing ENOSYS *or* EPERM.

[ 3377.717182] potentially unexpected fatal signal 31.
[ 3377.797210] CPU: 0 PID: 5935 Comm: chrome Tainted: G                T 5.14.0-rc1-next-20210714-dirty #19 d24ebf564a0c1611935300e71924884963eef3a1
[ 3377.877246] Hardware name: TOSHIBA Satellite C55-B/ZBWAA, BIOS 5.00 07/23/2015

asm-generic/errno-base.h:#define	EMLINK		31	/* Too many links */

Comment 4 Florian Weimer 2021-07-26 12:32:03 UTC

(In reply to Valdis Kletnieks from comment #3)
> Well, I just got bit by the glibc starting using it as per bug #1985800, and
> it isn't throwing ENOSYS *or* EPERM.
> 
> [ 3377.717182] potentially unexpected fatal signal 31.
> [ 3377.797210] CPU: 0 PID: 5935 Comm: chrome Tainted: G                T
> 5.14.0-rc1-next-20210714-dirty #19 d24ebf564a0c1611935300e71924884963eef3a1
> [ 3377.877246] Hardware name: TOSHIBA Satellite C55-B/ZBWAA, BIOS 5.00
> 07/23/2015
> 
> asm-generic/errno-base.h:#define	EMLINK		31	/* Too many links */

Signal 31 is SIGSYS, so it's also seccomp related. It's an emulation trap. In-process emulation will not work in this context because for correctness, glibc needs to disable signals before calling clone3.

Comment 5 Valdis Kletnieks 2021-07-26 12:47:27 UTC

Gaah.  I was looking at errno, not signal numbers.  -ENOCAFFEINE :)

Comment 6 Ben Cotton 2021-08-10 13:09:23 UTC

This bug appears to have been reported against 'rawhide' during the Fedora 35 development cycle.
Changing version to 35.

Comment 7 Fedora Update System 2021-09-05 13:13:25 UTC

FEDORA-2021-78b9d84299 has been submitted as an update to Fedora 33. https://bodhi.fedoraproject.org/updates/FEDORA-2021-78b9d84299

Comment 8 Fedora Update System 2021-09-05 13:13:26 UTC

FEDORA-2021-02b301441f has been submitted as an update to Fedora 35. https://bodhi.fedoraproject.org/updates/FEDORA-2021-02b301441f

Comment 9 Fedora Update System 2021-09-05 13:13:29 UTC

FEDORA-2021-6225d60814 has been submitted as an update to Fedora 34. https://bodhi.fedoraproject.org/updates/FEDORA-2021-6225d60814

Comment 10 Fedora Update System 2021-09-05 19:55:09 UTC

FEDORA-2021-02b301441f has been pushed to the Fedora 35 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2021-02b301441f`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2021-02b301441f

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 11 Fedora Update System 2021-09-05 21:23:08 UTC

FEDORA-2021-6225d60814 has been pushed to the Fedora 34 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2021-6225d60814`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2021-6225d60814

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 12 Fedora Update System 2021-09-05 21:29:18 UTC

FEDORA-2021-78b9d84299 has been pushed to the Fedora 33 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2021-78b9d84299`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2021-78b9d84299

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 13 Fedora Update System 2021-09-13 03:42:28 UTC

FEDORA-2021-6225d60814 has been pushed to the Fedora 34 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 14 Fedora Update System 2021-09-13 03:48:39 UTC

FEDORA-2021-78b9d84299 has been pushed to the Fedora 33 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 15 Fedora Update System 2021-09-13 13:07:25 UTC

FEDORA-2021-6225d60814 has been pushed to the Fedora 34 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 16 Fedora Update System 2021-09-24 20:16:14 UTC

FEDORA-2021-02b301441f has been pushed to the Fedora 35 stable repository.
If problem still persists, please make note of it in this bug report.