fix: crash in seccomp sandbox with glibc 2.34 #31091
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
deepak1556
added
13-x-y
backport-check-skip
jkleinsc
approved these changes
Sep 23, 2021
|
Release Notes Persisted
|
|
I have automatically backported this PR to "12-x-y", please check out #31096 |
|
do we have any ETA for a new 13.x release? TIA |
3 tasks
|
This is now released in |
This was referenced Sep 28, 2021
1 task
gentoo-bot
pushed a commit
to gentoo/glibc
that referenced
this pull request
Feb 3, 2022
We're disabling clone3 for now _CONDITIONALLY_ (not by default) to allow compatibility with applications using older Electron. Use -DGENTOO_USE_CLONE3 to enable clone3 for now. In future, we will revert back to always using clone3. This was impacting e.g. Discord and Skype. This patch stops glibc from using clone3 internally (which is the only real use of it) and falls back to the old behaviour. Specifically, we want electron/electron#31091 to work its way downstream to various Electron applications. https://bugs.gentoo.org/819045 https://bugs.gentoo.org/827386 https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/glibc/plain/debian/patches/ubuntu/disable-clone3.patch This is the same as the patch that was considered but ultimately rejected for 2.34 because Docker got sorted out in time: https://patchwork.ozlabs.org/project/glibc/patch/[email protected]/. Signed-off-by: Sam James <[email protected]>
6 tasks
2 tasks
This was referenced May 17, 2022
2 tasks
2 tasks
lfmunoz
reviewed
Jan 17, 2023
| Subject: Linux sandbox: return ENOSYS for clone3 | ||
|
|
||
| Because clone3 uses a pointer argument rather than a flags argument, we | ||
| cannot examine the contents with seccomp, which is essential to |
There was a problem hiding this comment.
"with seccomp enabled" would better . The way is written makes me think seccomp is used to examine contents
This was referenced Aug 9, 2024
zatrazz
pushed a commit
to zatrazz/glibc
that referenced
this pull request
Oct 8, 2024
This patch was originally carried in Gentoo to make clone3 optional to avoid breakage for CEF/steam/zoom, and others. Gentoo made clone3 mandatory but ChromeOS is not there yet, so we carry this trivial patch to allow us to keep clone3 disabled for a while longer. See b:288928916 which is tracking the clone3 migration. Original commit message: We're disabling clone3 for now _CONDITIONALLY_ (not by default) to allow compatibility with applications using older Electron. Use -DGENTOO_USE_CLONE3 to enable clone3 for now. In future, we will revert back to always using clone3. This was impacting e.g. Discord and Skype. This patch stops glibc from using clone3 internally (which is the only real use of it) and falls back to the old behaviour. Specifically, we want electron/electron#31091 to work its way downstream to various Electron applications. https://bugs.gentoo.org/819045 https://bugs.gentoo.org/827386 https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/glibc/plain/debian/patches/ubuntu/disable-clone3.patch This is the same as the patch that was considered but ultimately rejected for 2.34 because Docker got sorted out in time: https://patchwork.ozlabs.org/project/glibc/patch/[email protected]/. Signed-off-by: Sam James <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description of Change
Refs https://bugs.launchpad.net/ubuntu/+source/glibc/+bug/1944468
Refs https://bugs.chromium.org/p/chromium/issues/detail?id=1244383
Refs https://bugs.chromium.org/p/chromium/issues/detail?id=1213452
The fix is available in Electron >= 14
Checklist
npm testpassesRelease Notes
Notes: fix crash in seccomp sandbox with glibc 2.34