Bug#973811: tracker-miners sandbox

2021-04-07 Thread Bernhard Übelacker

Hello Roderich,
I looked a little around and found Debian bug #967941.
There the media file is a video file that led
to loading libopenblas.so. This seems to be caused
by the file gstreamer-1.0/libgstlibav.so.

I could reproduce it now within a VM with current testing.
By creating a mkv video container containing dummy h264 video.

This made tracker-extract crash with the same backtrace.

Details creating the test video file and some more
details in attached file.

Kind regards,
Bernhard

# single-use Bullseye/testing amd64 qemu VM 2021-04-07

echo "set enable-bracketed-paste off" >> /etc/inputrc; bash

apt update

# to speedup testing
mv /etc/manpath.config /etc/manpath.config.renamed
apt install libeatmydata1
export LD_PRELOAD=/usr/lib/$(uname -m)-linux-gnu/libeatmydata.so

apt dist-upgrade
apt install systemd-coredump gnome gdb tracker-extract libopenblas0-pthread 
totem mediainfo youtube-dl \
tracker-extract-dbgsym libopenblas0-pthread-dbgsym
apt build-dep tracker-extract

reboot




mkdir /home/benutzer/source/libopenblas0-pthread/orig -p
cd/home/benutzer/source/libopenblas0-pthread/orig
apt source libopenblas0-pthread
cd





ffmpeg -f lavfi -i testsrc=duration=10:size=1280x720:rate=30 -vcodec h264 
-acodec libvorbis output.mkv



benutzer@debian:~$ mediainfo output.mkv 
General
Unique ID: 
86504292601449332751262688530610519286 (0x41141EE912C532EEC70F1D7D7877FCF6)
Complete name: output.mkv
Format   : Matroska
Format version   : Version 4
File size: 118 KiB
Duration : 10 s 0 ms
Overall bit rate : 96.8 kb/s
Writing application  : Lavf58.45.100
Writing library  : Lavf58.45.100
ErrorDetectionType   : Per level 1

Video
ID   : 1
Format   : AVC
Format/Info  : Advanced Video Codec
Format profile   : High 4:4:4 Predictive@L3.1
Format settings  : CABAC / 4 Ref Frames
Format settings, CABAC   : Yes
Format settings, Reference frames: 4 frames
Codec ID : V_MPEG4/ISO/AVC
Duration : 10 s 0 ms
Bit rate : 94.9 kb/s
Width: 1 280 pixels
Height   : 720 pixels
Display aspect ratio : 16:9
Frame rate mode  : Constant
Frame rate   : 30.000 FPS
Chroma subsampling   : 4:4:4
Bit depth: 8 bits
Scan type: Progressive
Bits/(Pixel*Frame)   : 0.003
Stream size  : 116 KiB (98%)
Writing library  : x264 core 160 r3011 cde9a93
Encoding settings: cabac=1 / ref=3 / deblock=1:0:0 / 
analyse=0x3:0x113 / me=hex / subme=7 / psy=1 / psy_rd=1.00:0.00 / mixed_ref=1 / 
me_range=16 / chroma_me=1 / trellis=1 / 8x8dct=1 / cqm=0 / deadzone=21,11 / 
fast_pskip=1 / chroma_qp_offset=4 / threads=22 / lookahead_threads=3 / 
sliced_threads=0 / nr=0 / decimate=1 / interlaced=0 / bluray_compat=0 / 
constrained_intra=0 / bframes=3 / b_pyramid=2 / b_adapt=1 / b_bias=0 / direct=1 
/ weightb=1 / open_gop=0 / weightp=2 / keyint=250 / keyint_min=25 / scenecut=40 
/ intra_refresh=0 / rc_lookahead=40 / rc=crf / mbtree=1 / crf=23.0 / qcomp=0.60 
/ qpmin=0 / qpmax=69 / qpstep=4 / ip_ratio=1.40 / aq=1:1.00
Default  : Yes
Forced   : No




journalctl --user -e:
Apr 07 17:17:04 debian systemd[1093]: Starting Tracker metadata extractor...
Apr 07 17:17:04 debian tracker-extract[2304]: Set scheduler policy to SCHED_IDLE
Apr 07 17:17:04 debian tracker-extract[2304]: Setting priority nice level to 19
Apr 07 17:17:04 debian dbus-daemon[1120]: [session uid=1000 pid=1120] 
Successfully activated service 'org.freedesktop.Tracker1.Miner.Extract'
Apr 07 17:17:04 debian systemd[1093]: Started Tracker metadata extractor.
Apr 07 17:17:05 debian systemd-coredump[2328]: Process 2304 (tracker-extract) 
of user 1000 dumped core.
   
   Stack trace of thread 2324:
   #0  0x7f6dd97b89b9 syscall 
(libc.so.6 + 0xf89b9)
   #1  0x7f6d73b902ce my_mbind 
(libopenblas.so.0 + 0x34a2ce)
   #2  0x7f6d73b90709 
blas_memory_alloc (libopenblas.so.0 + 0x34a709)
   #3  0x7f6d73b90f04 
blas_thread_server 

Bug#973811: tracker-miners sandbox

2021-04-06 Thread Roderich Schupp
Hi Bernhard (OP here),

>  Might this be a kind of sandbox, not allowing
>  to allocate memory the way libopenblas.so does/did?

You can see the seccomp sandbox used by tracker-miners here:
https://sources.debian.org/src/tracker-miners/2.3.5-2/src/libtracker-miners-common/tracker-seccomp.c/?hl=71#L71

In particular, it does not ALLOW syscalls mbind and set_mempolicy.

Maybe tracker-miners should be modified. OTOH, I'm not sure why
openblas is actually involved in this
(I never found out which file on my disk triggered this).

Cheers, Roderich