New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 897951 link

Starred by 1 user
Status: Fixed
Owner:
█ yunlian@chromium.org
Last visit > 30 days ago
Closed: Nov 8
Cc:
█ lhchavez@chromium.org
█ abrestic@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 2
Type: Bug
Build-Toolchain

Blocking:
issue 834385



Sign in to add a comment

security_AltSyscall failed on kevin board with glibc 2.27

Project Member Reported by yunlian@chromium.org, Oct 22 
With glibc 2.27,
I got error
 /sbin/minijail0 -a read_write_test -- /usr/local/autotest/tests/security_AltSyscall/src/read

returned 1 instead of 0

I ran
 /sbin/minijail0  -- /usr/local/autotest/tests/security_AltSyscall/src/read and it returned 0

Comment 1 by yunlian@chromium.org, Oct 23 

The strace shows that exit_group() is not implemented. Maybe we should add it to
read_write_test ?
probably here?
https://cs.corp.google.com/chromeos_public/src/third_party/kernel/v4.4/security/chromiumos/read_write_test_whitelists.h?l=30


[pid  7079] getgid32()                  = 0
[pid  7079] read(3, "\320\4\0\0", 4)    = 4
[pid  7079] read(3, "\0\0\0\0!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1232) = 1232
[pid  7079] close(3)                    = 0
[pid  7079] prctl(0x43724f53 /* PR_??? */, 0x1, 0x7352b08, 0, 0x7352630) = 0
[pid  7079] openat(AT_FDCWD, "/dev/zero", O_RDONLY) = -1 ENOSYS (Function not implemented)
[pid  7079] exit_group(1)               = -1 ENOSYS (Function not implemented)
[pid  7079] exit(1)                     = ?
[pid  7079] +++ exited with 1 +++

Comment 2 by vapier@chromium.org, Oct 23 

seems like the error is due to openat, not exit_group ?

if exit_group was allowed, then it would have exited 1 and caused the test to fail anyways ?

Comment 3 by yunlian@chromium.org, Oct 23 

Yes, it is due to openat.
If I add openat at
https://cs.corp.google.com/chromeos_public/src/third_party/kernel/v4.4/security/chromiumos/read_write_test_whitelists.h?l=45
The test passed
I will upload a patch for that.
Project Member

Comment 4 by bugdroid1@chromium.org, Oct 24

Labels: merge-merged-chromeos-4.14
The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/e061643ece564a23d2ff6376719ccdddb7d143e1

commit e061643ece564a23d2ff6376719ccdddb7d143e1
Author: Yunlian Jiang <yunlian@google.com>
Date: Wed Oct 24 20:03:06 2018

CHROMIUM: add openat to altsyscall test list

glibc 2.27 uses 'openat' system call when calling 'open()', we
need to add this to system call whitelist accordingly.

Signed-off-by: Yunlian Jiang <yunlian@chromium.org>
BUG= chromium:897951 
TEST=security_AltSyscall passes on kevin with glibc 2.27

Change-Id: Ie9e23b4d9ff9a05f6d733893a582f696a439fa19
Reviewed-on: https://chromium-review.googlesource.com/1296815
Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com>
Tested-by: Yunlian Jiang <yunlian@chromium.org>
Reviewed-by: Luis Lozano <llozano@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>

[modify] https://crrev.com/e061643ece564a23d2ff6376719ccdddb7d143e1/security/chromiumos/read_write_test_whitelists.h
Project Member

Comment 5 by bugdroid1@chromium.org, Oct 24

Labels: merge-merged-chromeos-4.4
The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/30a7a6ab5cfc5640a9ef78b0d6f2e0ae5640dd4b

commit 30a7a6ab5cfc5640a9ef78b0d6f2e0ae5640dd4b
Author: Yunlian Jiang <yunlian@google.com>
Date: Wed Oct 24 23:45:12 2018

CHROMIUM: add openat to altsyscall test list

glibc 2.27 uses 'openat' system call when calling 'open()', we
need to add this to system call whitelist accordingly.

Signed-off-by: Yunlian Jiang <yunlian@chromium.org>
BUG= chromium:897951 
TEST=security_AltSyscall passes on kevin with glibc 2.27

Change-Id: I79fdf1a60c1c81ee9605ea3741f8262873e63154
Reviewed-on: https://chromium-review.googlesource.com/1296326
Commit-Ready: Yunlian Jiang <yunlian@chromium.org>
Tested-by: Yunlian Jiang <yunlian@chromium.org>
Reviewed-by: Luis Lozano <llozano@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>

[modify] https://crrev.com/30a7a6ab5cfc5640a9ef78b0d6f2e0ae5640dd4b/security/chromiumos/read_write_test_whitelists.h

Comment 6 by manojgupta@chromium.org, Nov 8

Owner: yunlian@chromium.org
Status: Fixed (was: Untriaged)
Project Member

Comment 7 by bugdroid1@chromium.org, Nov 17

Labels: merge-merged-chromeos-4.19
The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/c5227784b3f7feb3630b62b4a4914d506d399536

commit c5227784b3f7feb3630b62b4a4914d506d399536
Author: Yunlian Jiang <yunlian@google.com>
Date: Sat Nov 17 20:00:07 2018

CHROMIUM: add openat to altsyscall test list

glibc 2.27 uses 'openat' system call when calling 'open()', we
need to add this to system call whitelist accordingly.

Signed-off-by: Yunlian Jiang <yunlian@chromium.org>
BUG= chromium:897951 
TEST=security_AltSyscall passes on kevin with glibc 2.27

Change-Id: Ie9e23b4d9ff9a05f6d733893a582f696a439fa19
Reviewed-on: https://chromium-review.googlesource.com/1296815
Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com>
Tested-by: Yunlian Jiang <yunlian@chromium.org>
Reviewed-by: Luis Lozano <llozano@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
(cherry picked from commit e061643ece564a23d2ff6376719ccdddb7d143e1)
Reviewed-on: https://chromium-review.googlesource.com/1340529
Commit-Ready: Manoj Gupta <manojgupta@chromium.org>
Tested-by: Manoj Gupta <manojgupta@chromium.org>
Reviewed-by: Manoj Gupta <manojgupta@chromium.org>

[modify] https://crrev.com/c5227784b3f7feb3630b62b4a4914d506d399536/security/chromiumos/read_write_test_whitelists.h
Project Member

Comment 8 by bugdroid1@chromium.org, Nov 17

Labels: merge-merged-chromeos-3.18
The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/f055fa2cbd3373698059e9f22846e2ac3f1f6454

commit f055fa2cbd3373698059e9f22846e2ac3f1f6454
Author: Yunlian Jiang <yunlian@google.com>
Date: Sat Nov 17 20:00:09 2018

CHROMIUM: add openat to altsyscall test list

glibc 2.27 uses 'openat' system call when calling 'open()', we
need to add this to system call whitelist accordingly.

Signed-off-by: Yunlian Jiang <yunlian@chromium.org>
BUG= chromium:897951 
TEST=security_AltSyscall passes on kevin with glibc 2.27

Change-Id: Ie9e23b4d9ff9a05f6d733893a582f696a439fa19
Reviewed-on: https://chromium-review.googlesource.com/1296815
Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com>
Tested-by: Yunlian Jiang <yunlian@chromium.org>
Reviewed-by: Luis Lozano <llozano@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
(cherry picked from commit e061643ece564a23d2ff6376719ccdddb7d143e1)
Reviewed-on: https://chromium-review.googlesource.com/1340503
Commit-Ready: Manoj Gupta <manojgupta@chromium.org>
Tested-by: Manoj Gupta <manojgupta@chromium.org>
Reviewed-by: Manoj Gupta <manojgupta@chromium.org>
Reviewed-by: Micah Morton <mortonm@chromium.org>

[modify] https://crrev.com/f055fa2cbd3373698059e9f22846e2ac3f1f6454/security/chromiumos/read_write_test_whitelists.h
Project Member

Comment 9 by bugdroid1@chromium.org, Nov 18

Labels: merge-merged-chromeos-3.14
The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/9268d94d956c00a0e3614ac4d2d20132059b75d5

commit 9268d94d956c00a0e3614ac4d2d20132059b75d5
Author: Yunlian Jiang <yunlian@google.com>
Date: Sun Nov 18 00:41:40 2018

CHROMIUM: add openat to altsyscall test list

glibc 2.27 uses 'openat' system call when calling 'open()', we
need to add this to system call whitelist accordingly.

Signed-off-by: Yunlian Jiang <yunlian@chromium.org>
BUG= chromium:897951 
TEST=security_AltSyscall passes on kevin with glibc 2.27

Change-Id: Ie9e23b4d9ff9a05f6d733893a582f696a439fa19
Reviewed-on: https://chromium-review.googlesource.com/1296815
Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com>
Tested-by: Yunlian Jiang <yunlian@chromium.org>
Reviewed-by: Luis Lozano <llozano@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
(cherry picked from commit e061643ece564a23d2ff6376719ccdddb7d143e1)
Reviewed-on: https://chromium-review.googlesource.com/1340525
Commit-Ready: Manoj Gupta <manojgupta@chromium.org>
Tested-by: Manoj Gupta <manojgupta@chromium.org>
Reviewed-by: Manoj Gupta <manojgupta@chromium.org>
Reviewed-by: Micah Morton <mortonm@chromium.org>

[modify] https://crrev.com/9268d94d956c00a0e3614ac4d2d20132059b75d5/security/chromiumos/read_write_test_whitelists.h
►

Sign in to add a comment