Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libqt5-qtwebengine for openSUSE:Factory checked in at 2021-02-15 23:14:59 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libqt5-qtwebengine (Old) and /work/SRC/openSUSE:Factory/.libqt5-qtwebengine.new.28504 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libqt5-qtwebengine" Mon Feb 15 23:14:59 2021 rev:65 rq:872643 version:5.15.2 Changes: -------- --- /work/SRC/openSUSE:Factory/libqt5-qtwebengine/libqt5-qtwebengine.changes 2021-02-01 13:25:26.685845156 +0100 +++ /work/SRC/openSUSE:Factory/.libqt5-qtwebengine.new.28504/libqt5-qtwebengine.changes 2021-02-15 23:17:09.839473206 +0100 @@ -1,0 +2,6 @@ +Mon Feb 15 16:28:49 UTC 2021 - Fabian Vogt <fab...@ritter-vogt.de> + +- Add patch to fix sandbox with glibc 2.33 (boo#1182233): + * chromium-glibc-2.33.patch + +------------------------------------------------------------------- New: ---- chromium-glibc-2.33.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libqt5-qtwebengine.spec ++++++ --- /var/tmp/diff_new_pack.hA7SYS/_old 2021-02-15 23:17:12.035476486 +0100 +++ /var/tmp/diff_new_pack.hA7SYS/_new 2021-02-15 23:17:12.035476486 +0100 @@ -51,9 +51,10 @@ Source: https://download.qt.io/official_releases/qt/5.15/%{real_version}/submodules/%{tar_version}.tar.xz # PATCH-FIX-UPSTREAM armv6-ffmpeg-no-thumb.patch - Fix ffmpeg configuration for armv6 Patch1: armv6-ffmpeg-no-thumb.patch -# PATCH-FIX-UPSTREAM disable-gpu-when-using-nouveau-boo-1005323.diff +# PATCH-FIX-OPENSUSE disable-gpu-when-using-nouveau-boo-1005323.diff Patch2: disable-gpu-when-using-nouveau-boo-1005323.diff Patch7: fix1163766.patch +Patch8: chromium-glibc-2.33.patch # PATCH-FIX-OPENSUSE Patch9: rtc-dont-use-h264.patch # PATCH-FIX-UPSTREAM ++++++ chromium-glibc-2.33.patch ++++++ # Patch made by Kevin Kofler <ke...@tigcc.ticalc.org> # https://bugzilla.redhat.com/show_bug.cgi?id=1904652 Index: qtwebengine-everywhere-src-5.15.2/src/3rdparty/chromium/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc =================================================================== --- qtwebengine-everywhere-src-5.15.2.orig/src/3rdparty/chromium/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc +++ qtwebengine-everywhere-src-5.15.2/src/3rdparty/chromium/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc @@ -253,6 +253,18 @@ ResultExpr EvaluateSyscallImpl(int fs_de return RestrictKillTarget(current_pid, sysno); } +#if defined(__NR_newfstatat) + if (sysno == __NR_newfstatat) { + return RewriteFstatatSIGSYS(); + } +#endif + +#if defined(__NR_fstatat64) + if (sysno == __NR_fstatat64) { + return RewriteFstatatSIGSYS(); + } +#endif + if (SyscallSets::IsFileSystem(sysno) || SyscallSets::IsCurrentDirectory(sysno)) { return Error(fs_denied_errno); Index: qtwebengine-everywhere-src-5.15.2/src/3rdparty/chromium/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc =================================================================== --- qtwebengine-everywhere-src-5.15.2.orig/src/3rdparty/chromium/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc +++ qtwebengine-everywhere-src-5.15.2/src/3rdparty/chromium/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc @@ -6,6 +6,8 @@ #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h" +#include <errno.h> +#include <fcntl.h> #include <stddef.h> #include <stdint.h> #include <sys/syscall.h> @@ -353,6 +355,35 @@ intptr_t SIGSYSSchedHandler(const struct return -ENOSYS; } +intptr_t SIGSYSFstatatHandler(const struct arch_seccomp_data& args, + void* aux) { + switch (args.nr) { +#if defined(__NR_newfstatat) + case __NR_newfstatat: +#endif +#if defined(__NR_fstatat64) + case __NR_fstatat64: +#endif +#if defined(__NR_newfstatat) || defined(__NR_fstatat64) + if (*reinterpret_cast<const char *>(args.args[1]) == '\0' + && args.args[3] == static_cast<uint64_t>(AT_EMPTY_PATH)) { + return sandbox::sys_fstat64(static_cast<int>(args.args[0]), + reinterpret_cast<struct stat64 *>(args.args[2])); + } else { + errno = EACCES; + return -1; + } + break; +#endif + } + + CrashSIGSYS_Handler(args, aux); + + // Should never be reached. + RAW_CHECK(false); + return -ENOSYS; +} + bpf_dsl::ResultExpr CrashSIGSYS() { return bpf_dsl::Trap(CrashSIGSYS_Handler, NULL); } @@ -385,6 +416,10 @@ bpf_dsl::ResultExpr RewriteSchedSIGSYS() return bpf_dsl::Trap(SIGSYSSchedHandler, NULL); } +bpf_dsl::ResultExpr RewriteFstatatSIGSYS() { + return bpf_dsl::Trap(SIGSYSFstatatHandler, NULL); +} + void AllocateCrashKeys() { #if !defined(OS_NACL_NONSFI) if (seccomp_crash_key) Index: qtwebengine-everywhere-src-5.15.2/src/3rdparty/chromium/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h =================================================================== --- qtwebengine-everywhere-src-5.15.2.orig/src/3rdparty/chromium/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h +++ qtwebengine-everywhere-src-5.15.2/src/3rdparty/chromium/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h @@ -63,6 +63,11 @@ SIGSYSPtraceFailure(const struct arch_se SANDBOX_EXPORT intptr_t SIGSYSSchedHandler(const struct arch_seccomp_data& args, void* aux); +// If the fstatat syscall is actually a disguised fstat, calls the regular fstat +// syscall, otherwise, crashes in the same way as CrashSIGSYS_Handler. +SANDBOX_EXPORT intptr_t SIGSYSFstatatHandler(const struct arch_seccomp_data& args, + void* aux); + // Variants of the above functions for use with bpf_dsl. SANDBOX_EXPORT bpf_dsl::ResultExpr CrashSIGSYS(); SANDBOX_EXPORT bpf_dsl::ResultExpr CrashSIGSYSClone(); @@ -72,6 +77,7 @@ SANDBOX_EXPORT bpf_dsl::ResultExpr Crash SANDBOX_EXPORT bpf_dsl::ResultExpr CrashSIGSYSFutex(); SANDBOX_EXPORT bpf_dsl::ResultExpr CrashSIGSYSPtrace(); SANDBOX_EXPORT bpf_dsl::ResultExpr RewriteSchedSIGSYS(); +SANDBOX_EXPORT bpf_dsl::ResultExpr RewriteFstatatSIGSYS(); // Allocates a crash key so that Seccomp information can be recorded. void AllocateCrashKeys(); Index: qtwebengine-everywhere-src-5.15.2/src/3rdparty/chromium/sandbox/linux/services/syscall_wrappers.cc =================================================================== --- qtwebengine-everywhere-src-5.15.2.orig/src/3rdparty/chromium/sandbox/linux/services/syscall_wrappers.cc +++ qtwebengine-everywhere-src-5.15.2/src/3rdparty/chromium/sandbox/linux/services/syscall_wrappers.cc @@ -261,4 +261,13 @@ int sys_sigaction(int signum, #endif // defined(MEMORY_SANITIZER) +SANDBOX_EXPORT int sys_fstat64(int fd, struct stat64 *buf) +{ +#if defined(__NR_fstat64) + return syscall(__NR_fstat64, fd, buf); +#else + return syscall(__NR_fstat, fd, buf); +#endif +} + } // namespace sandbox Index: qtwebengine-everywhere-src-5.15.2/src/3rdparty/chromium/sandbox/linux/services/syscall_wrappers.h =================================================================== --- qtwebengine-everywhere-src-5.15.2.orig/src/3rdparty/chromium/sandbox/linux/services/syscall_wrappers.h +++ qtwebengine-everywhere-src-5.15.2/src/3rdparty/chromium/sandbox/linux/services/syscall_wrappers.h @@ -17,6 +17,7 @@ struct sock_fprog; struct rlimit64; struct cap_hdr; struct cap_data; +struct stat64; namespace sandbox { @@ -84,6 +85,9 @@ SANDBOX_EXPORT int sys_sigaction(int sig const struct sigaction* act, struct sigaction* oldact); +// Recent glibc rewrites fstat to fstatat. +SANDBOX_EXPORT int sys_fstat64(int fd, struct stat64 *buf); + } // namespace sandbox #endif // SANDBOX_LINUX_SERVICES_SYSCALL_WRAPPERS_H_
