glibc 2.27 changed some internal system calls to a certain function.
To make sure programs does not crash because of these glibc internal changes,
we want to make the changes fo policy files as follows
- getpid: add it to all policy files, this should be safe.
- openat only add it to the policy file if there is already an "open" in the file
- prlimit64, add it in read-only mode if getrlimit is in the file
added in write mode if setrlimit is there.
Otherwise dont add it.
The script to make such changes are
for i in `find . -name "*.policy"`; do
if ! grep -q 'getpid' $i; then
echo $i >> ~/modified
echo 'getpid: 1' >> $i
fi
if ! grep -q 'prlimit64' $i; then
if grep -q 'setrlimit:' $i; then
echo 'prlimit64: 1' >> $i
echo $i >> ~/modified
elif grep -q 'getrlimit:' $i; then
echo 'prlimit64: arg2 == 0 && arg3 != 0' >> $i
echo $i >> ~/modified
fi
fi
if grep -q 'open:' $i; then
if ! grep -q 'openat:' $i; then
echo $i >> ~/modified
sed '/open: 1/a openat: 1' -i $i
fi
fi
done
Comment 1 by yunlian@chromium.org
, Oct 21