[Bug 1450642] Re: seccomp missing many new syscalls
** Changed in: snappy/15.04 Status: Fix Committed = Fix Released -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to libseccomp in Ubuntu. https://bugs.launchpad.net/bugs/1450642 Title: seccomp missing many new syscalls To manage notifications about this bug go to: https://bugs.launchpad.net/snappy/+bug/1450642/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1450642] Re: seccomp missing many new syscalls
** Also affects: snappy/15.04 Importance: Undecided Status: New ** Changed in: snappy/15.04 Milestone: None = 15.04.1 ** Changed in: snappy/15.04 Assignee: (unassigned) = Jamie Strandboge (jdstrand) ** Changed in: snappy/15.04 Status: New = Fix Committed ** Changed in: snappy Status: Fix Committed = Fix Released -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to libseccomp in Ubuntu. https://bugs.launchpad.net/bugs/1450642 Title: seccomp missing many new syscalls To manage notifications about this bug go to: https://bugs.launchpad.net/snappy/+bug/1450642/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1450642] Re: seccomp missing many new syscalls
** Branch linked: lp:ubuntu/libseccomp ** Branch linked: lp:~ubuntu-branches/ubuntu/vivid/libseccomp/vivid- proposed -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to libseccomp in Ubuntu. https://bugs.launchpad.net/bugs/1450642 Title: seccomp missing many new syscalls To manage notifications about this bug go to: https://bugs.launchpad.net/snappy/+bug/1450642/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1450642] Re: seccomp missing many new syscalls
This bug was fixed in the package libseccomp - 2.1.1-1ubuntu1~vivid2 --- libseccomp (2.1.1-1ubuntu1~vivid2) vivid-proposed; urgency=medium * add-finit-module.patch: add finit_module syscalls to x86 and x86-64 syscall tables * update syscalls for modern kernels (skipping MIPS) - update syscalls for 3.16: + update-x86-syscall-table.patch + update-x86_64-syscall-table.patch + update-arm-syscall-table.patch + update-x32-syscall-table.patch + sync-syscall-table-entries.patch + sync-syscall-table-entries-fixtypo.patch - update syscalls for 3.17: + sync-syscall-table-entries-3.17.patch - update syscalls for 3.19: + sync-syscall-table-entries-3.19.patch - LP: #1450642 * fix-segfault-with-unknown.patch: fix segfault when find unknown syscall * debian/patches/add-missing-arm-private-syscalls.path: add missing private ARM syscalls * add autopkgtests for scmp_sys_resolver and filter testing and SYS_getrandom() testing -- Jamie Strandboge ja...@ubuntu.com Fri, 08 May 2015 17:10:14 -0400 ** Changed in: libseccomp (Ubuntu Vivid) Status: Fix Committed = Fix Released -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to libseccomp in Ubuntu. https://bugs.launchpad.net/bugs/1450642 Title: seccomp missing many new syscalls To manage notifications about this bug go to: https://bugs.launchpad.net/snappy/+bug/1450642/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1450642] Re: seccomp missing many new syscalls
** Project changed: snappy-ubuntu = snappy -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to libseccomp in Ubuntu. https://bugs.launchpad.net/bugs/1450642 Title: seccomp missing many new syscalls To manage notifications about this bug go to: https://bugs.launchpad.net/snappy/+bug/1450642/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1450642] Re: seccomp missing many new syscalls
Test cases pass with packages in vivid-proposed: * in build testsuite results are same between previous build and this for all archs: PASS * scmp_sys_resolver 1024: PASS * scmp_sys_resolver getrandom: PASS * autopkgtests: PASS * lxc (amd64 and i386 only): PASS * docker framework (snappy/armhf): PASS * snappy hello-world.env (snappy/armhf): PASS As a further data point, this package is source-identical to what is in wily (other than the debian/changelog) and wily's update made it through proposed migration and lxc's tests all passed: https://jenkins.qa.ubuntu.com/job/wily-adt-lxc/lastBuild/ARCH=amd64,label=adt/artifact/results/log https://jenkins.qa.ubuntu.com/job/wily-adt-lxc/lastBuild/ARCH=i386,label=adt/artifact/results/log ** Tags removed: verification-needed ** Tags added: verification-done ** Changed in: snappy-ubuntu Status: In Progress = Fix Committed -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to libseccomp in Ubuntu. https://bugs.launchpad.net/bugs/1450642 Title: seccomp missing many new syscalls To manage notifications about this bug go to: https://bugs.launchpad.net/snappy-ubuntu/+bug/1450642/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1450642] Re: seccomp missing many new syscalls
Hello Jamie, or anyone else affected, Accepted libseccomp into vivid-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/libseccomp/2.1.1-1ubuntu1~vivid2 in a few hours, and then in the -proposed repository. Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users. If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision. Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance! ** Changed in: libseccomp (Ubuntu Vivid) Status: In Progress = Fix Committed ** Tags added: verification-needed -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to libseccomp in Ubuntu. https://bugs.launchpad.net/bugs/1450642 Title: seccomp missing many new syscalls To manage notifications about this bug go to: https://bugs.launchpad.net/snappy-ubuntu/+bug/1450642/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1450642] Re: seccomp missing many new syscalls
2.1.1-1ubuntu1~vivid2 uploaded. I'll upload 2.1.1-1ubuntu1 to wily in a few minutes. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to libseccomp in Ubuntu. https://bugs.launchpad.net/bugs/1450642 Title: seccomp missing many new syscalls To manage notifications about this bug go to: https://bugs.launchpad.net/snappy-ubuntu/+bug/1450642/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1450642] Re: seccomp missing many new syscalls
Actually, because that version number, 2.1.1-1ubuntu1~vivid1, has already been used in wily, we can't use the same version number in vivid. I'll reject the upload. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to libseccomp in Ubuntu. https://bugs.launchpad.net/bugs/1450642 Title: seccomp missing many new syscalls To manage notifications about this bug go to: https://bugs.launchpad.net/snappy-ubuntu/+bug/1450642/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1450642] Re: seccomp missing many new syscalls
Since 2.1.1-1ubuntu1~vivid1 is already in wily, I cannot accept this into vivid. Can you change the string in wily to not include ~vivid1 please? -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to libseccomp in Ubuntu. https://bugs.launchpad.net/bugs/1450642 Title: seccomp missing many new syscalls To manage notifications about this bug go to: https://bugs.launchpad.net/snappy-ubuntu/+bug/1450642/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1450642] Re: seccomp missing many new syscalls
** Also affects: libseccomp (Ubuntu Wily) Importance: Undecided Assignee: Jamie Strandboge (jdstrand) Status: In Progress ** Also affects: libseccomp (Ubuntu Vivid) Importance: Undecided Status: New ** Changed in: libseccomp (Ubuntu Vivid) Status: New = In Progress ** Changed in: libseccomp (Ubuntu Vivid) Assignee: (unassigned) = Jamie Strandboge (jdstrand) -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to libseccomp in Ubuntu. https://bugs.launchpad.net/bugs/1450642 Title: seccomp missing many new syscalls To manage notifications about this bug go to: https://bugs.launchpad.net/snappy-ubuntu/+bug/1450642/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1450642] Re: seccomp missing many new syscalls
** Changed in: libseccomp (Ubuntu Wily) Status: In Progress = Fix Committed -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to libseccomp in Ubuntu. https://bugs.launchpad.net/bugs/1450642 Title: seccomp missing many new syscalls To manage notifications about this bug go to: https://bugs.launchpad.net/snappy-ubuntu/+bug/1450642/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1450642] Re: seccomp missing many new syscalls
Uploaded the same version to wily (it is in unapproved). -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to libseccomp in Ubuntu. https://bugs.launchpad.net/bugs/1450642 Title: seccomp missing many new syscalls To manage notifications about this bug go to: https://bugs.launchpad.net/snappy-ubuntu/+bug/1450642/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1450642] Re: seccomp missing many new syscalls
This bug was fixed in the package libseccomp - 2.1.1-1ubuntu1~vivid1 --- libseccomp (2.1.1-1ubuntu1~vivid1) vivid-proposed; urgency=medium * add-finit-module.patch: add finit_module syscalls to x86 and x86-64 syscall tables * update syscalls for modern kernels (skipping MIPS) - update syscalls for 3.16: + update-x86-syscall-table.patch + update-x86_64-syscall-table.patch + update-arm-syscall-table.patch + update-x32-syscall-table.patch + sync-syscall-table-entries.patch + sync-syscall-table-entries-fixtypo.patch - update syscalls for 3.17: + sync-syscall-table-entries-3.17.patch - update syscalls for 3.19: + sync-syscall-table-entries-3.19.patch - LP: #1450642 * fix-segfault-with-unknown.patch: fix segfault when find unknown syscall * debian/patches/add-missing-arm-private-syscalls.path: add missing private ARM syscalls * add autopkgtests for scmp_sys_resolver and filter testing and SYS_getrandom() testing -- Jamie Strandboge ja...@ubuntu.com Mon, 04 May 2015 13:53:49 -0500 ** Changed in: libseccomp (Ubuntu Wily) Status: Fix Committed = Fix Released -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to libseccomp in Ubuntu. https://bugs.launchpad.net/bugs/1450642 Title: seccomp missing many new syscalls To manage notifications about this bug go to: https://bugs.launchpad.net/snappy-ubuntu/+bug/1450642/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1450642] Re: seccomp missing many new syscalls
** Description changed: - Several syscalls were discovered to be missing when using the launcher - on snappy. These should be added so we may properly support seccomp - filtering. + [Impact] + Several syscalls were discovered to be missing when using the launcher on snappy. These should be added so we may properly support seccomp filtering. + [Test Case] + seccomp itself has a comprehensive testsuite, and while it doesn't fail the build, regressions can be seen by looking at the build log. Eg: + + Regression Test Summary + tests run: 6494 + tests skipped: 52 + tests passed: 6494 + tests failed: 0 + tests errored: 0 + + + Furthermore, on a snappy system, perform: + $ sudo snappy install hello-world + $ hello-world.env + + It should show the environment. On an arm system with 2.1.1-1 from the archive, this will fail due to a seccomp denial: + audit: type=1326 audit(1430766107.122:16): auid=1000 uid=1000 gid=1000 ses=15 pid=1491 comm=env exe=/bin/bash sig=31 arch=4028 syscall=983045 compat=0 ip=0xb6fb0bd6 code=0x0 + + (note, snappy images have a ppa fix for this, see notes below). + + + To test the segfault fix, do: + $ scmp_sys_resolver 1024 + Segmentation fault + + It should return: + $ scmp_sys_resolver 1024 + UNKNOWN + + + For the new 3.19 syscalls: + $ scmp_sys_resolver getrandom + -1 + + it should return something like (actual number depends on arch, this is on armhf): + $ scmp_sys_resolver getrandom + 384 + + + autopkgtests for libseccomp have been added as part of this update to verify that the library recognizes all the syscalls from 3.19 and the private syscalls. These tests can be run like so (assuming you are in the unpacked source and the binaries are in ../binary): + $ export REL=vivid + $ adt-run `for i in ../binary/*.deb ; do echo -n -B $i ; done` --source ../source/*.dsc --log-file /tmp/adt.out --- adt-virt-schroot autopkgtest-$REL-amd64 || echo ** AUTOPKGTESTS FAILED + + Alternatively, if you don't have autopkgtest setup, you can do: + $ apt-get install dpkg-dev build-essential linux-libc-dev libseccomp-dev seccomp + $ export ADTTMP=/tmp/foo ; mkdir -p $ADTTMP ; sh ./debian/tests/test-filter + ... + PASS + $ export ADTTMP=/tmp/foo ; mkdir -p $ADTTMP ; sh ./debian/tests/test-scmp_sys_resolver + ... + PASS + + + Lastly, seccomp is used by lxc. lxc can be tested by using the test case as outlined in step 4 of https://wiki.ubuntu.com/Process/Merges/TestPlans/AppArmor#Desktop_only. + + + [Regression Potential] + If the above tests, regression potential is considered low. Unknown syscalls will continue to be handled as before. + + + Description of changes: add finit_module: https://github.com/seccomp/libseccomp/commit/64152018ffdf971efefd84466db4a92002bb8b15 sync the syscall table entries - 3.16 https://github.com/seccomp/libseccomp/commit/9186136be7696ed63a8ddc06c9b397057abc5c75 https://github.com/seccomp/libseccomp/commit/3f319a9a5bc2e32f5a3c296fb0476c040b6f46c4 https://github.com/seccomp/libseccomp/commit/689f19e7488535c775c1db415b8d9895905ef8dd https://github.com/seccomp/libseccomp/commit/ac6802b300922ef2ad3e95e2c80f89b575073aeb https://github.com/seccomp/libseccomp/commit/c6205d9600983aa3fa68ca952b7624f2fec86718 https://github.com/seccomp/libseccomp/commit/76739812a3e23182504cde43403ddb9921e0e05a sync the syscall table entries - 3.17 https://github.com/seccomp/libseccomp/commit/6354f8cab5ac82a8d567005e58a9e7ff9dd843a9 sync the syscall table entries - 3.19 https://github.com/seccomp/libseccomp/commit/7b80fb2fb683cafaf5dc9ff7692437ba86e598a3 - This should also be applied (fix a segfault for invalid syscall numbers): + This should also be applied (fix a segfault for invalid syscall numbers): https://github.com/seccomp/libseccomp/commit/2d09a74c7f04d29ae740db1e2187ff1a1886b2c3 + + In addition, add-missing-arm-private-syscalls.patch is add to add 5 + private ARM syscalls. These are absolutely required on snappy. This + portion of the patch has been well tested and is included by default in + stable snappy images via the snappy image PPA. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to libseccomp in Ubuntu. https://bugs.launchpad.net/bugs/1450642 Title: seccomp missing many new syscalls To manage notifications about this bug go to: https://bugs.launchpad.net/snappy-ubuntu/+bug/1450642/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
