From 82ff440ce80f6a03b150f768a2cba9469a8ec4f4 Mon Sep 17 00:00:00 2001 From: Tom spot Callaway Date: Mon, 25 Jan 2021 10:26:47 -0500 Subject: [PATCH 1/4] apply fix from Kevin Kofler for new glibc fstat sandbox handling --- chromium-88.0.4324.96-fstatfix.patch | 141 +++++++++++++++++++++++++++ chromium.spec | 9 +- 2 files changed, 149 insertions(+), 1 deletion(-) create mode 100644 chromium-88.0.4324.96-fstatfix.patch diff --git a/chromium-88.0.4324.96-fstatfix.patch b/chromium-88.0.4324.96-fstatfix.patch new file mode 100644 index 00000000..26e80039 --- /dev/null +++ b/chromium-88.0.4324.96-fstatfix.patch @@ -0,0 +1,141 @@ +diff -up chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc.fstatfix chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc +--- chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc.fstatfix 2021-01-25 10:11:45.427436398 -0500 ++++ chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc 2021-01-25 10:12:51.337699003 -0500 +@@ -257,6 +257,18 @@ ResultExpr EvaluateSyscallImpl(int fs_de + return RestrictKillTarget(current_pid, sysno); + } + ++#if defined(__NR_newfstatat) ++ if (sysno == __NR_newfstatat) { ++ return RewriteFstatatSIGSYS(); ++ } ++#endif ++ ++#if defined(__NR_fstatat64) ++ if (sysno == __NR_fstatat64) { ++ return RewriteFstatatSIGSYS(); ++ } ++#endif ++ + if (SyscallSets::IsFileSystem(sysno) || + SyscallSets::IsCurrentDirectory(sysno)) { + return Error(fs_denied_errno); +diff -up chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc.fstatfix chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc +--- chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc.fstatfix 2021-01-25 10:13:10.179774081 -0500 ++++ chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc 2021-01-25 10:16:18.790525746 -0500 +@@ -6,6 +6,8 @@ + + #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h" + ++#include ++#include + #include + #include + #include +@@ -355,6 +357,35 @@ intptr_t SIGSYSSchedHandler(const struct + return -ENOSYS; + } + ++intptr_t SIGSYSFstatatHandler(const struct arch_seccomp_data& args, ++ void* aux) { ++ switch (args.nr) { ++#if defined(__NR_newfstatat) ++ case __NR_newfstatat: ++#endif ++#if defined(__NR_fstatat64) ++ case __NR_fstatat64: ++#endif ++#if defined(__NR_newfstatat) || defined(__NR_fstatat64) ++ if (*reinterpret_cast(args.args[1]) == '\0' ++ && args.args[3] == static_cast(AT_EMPTY_PATH)) { ++ return sandbox::sys_fstat64(static_cast(args.args[0]), ++ reinterpret_cast(args.args[2])); ++ } else { ++ errno = EACCES; ++ return -1; ++ } ++ break; ++#endif ++ } ++ ++ CrashSIGSYS_Handler(args, aux); ++ ++ // Should never be reached. ++ RAW_CHECK(false); ++ return -ENOSYS; ++} ++ + bpf_dsl::ResultExpr CrashSIGSYS() { + return bpf_dsl::Trap(CrashSIGSYS_Handler, NULL); + } +@@ -387,6 +418,10 @@ bpf_dsl::ResultExpr RewriteSchedSIGSYS() + return bpf_dsl::Trap(SIGSYSSchedHandler, NULL); + } + ++bpf_dsl::ResultExpr RewriteFstatatSIGSYS() { ++ return bpf_dsl::Trap(SIGSYSFstatatHandler, NULL); ++} ++ + void AllocateCrashKeys() { + #if !defined(OS_NACL_NONSFI) + if (seccomp_crash_key) +diff -up chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h.fstatfix chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h +--- chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h.fstatfix 2021-01-25 10:16:36.982598236 -0500 ++++ chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h 2021-01-25 10:18:45.705111027 -0500 +@@ -62,6 +62,10 @@ SANDBOX_EXPORT intptr_t SIGSYSPtraceFail + // sched_setparam(), sched_setscheduler() + SANDBOX_EXPORT intptr_t SIGSYSSchedHandler(const arch_seccomp_data& args, + void* aux); ++// If the fstatat syscall is actually a disguised fstat, calls the regular fstat ++// syscall, otherwise, crashes in the same way as CrashSIGSYS_Handler. ++SANDBOX_EXPORT intptr_t SIGSYSFstatatHandler(const struct arch_seccomp_data& args, ++ void* aux); + + // Variants of the above functions for use with bpf_dsl. + SANDBOX_EXPORT bpf_dsl::ResultExpr CrashSIGSYS(); +@@ -72,6 +76,7 @@ SANDBOX_EXPORT bpf_dsl::ResultExpr Crash + SANDBOX_EXPORT bpf_dsl::ResultExpr CrashSIGSYSFutex(); + SANDBOX_EXPORT bpf_dsl::ResultExpr CrashSIGSYSPtrace(); + SANDBOX_EXPORT bpf_dsl::ResultExpr RewriteSchedSIGSYS(); ++SANDBOX_EXPORT bpf_dsl::ResultExpr RewriteFstatatSIGSYS(); + + // Allocates a crash key so that Seccomp information can be recorded. + void AllocateCrashKeys(); +diff -up chromium-88.0.4324.96/sandbox/linux/services/syscall_wrappers.cc.fstatfix chromium-88.0.4324.96/sandbox/linux/services/syscall_wrappers.cc +--- chromium-88.0.4324.96/sandbox/linux/services/syscall_wrappers.cc.fstatfix 2021-01-25 10:18:53.307141311 -0500 ++++ chromium-88.0.4324.96/sandbox/linux/services/syscall_wrappers.cc 2021-01-25 10:19:46.982355293 -0500 +@@ -261,4 +261,13 @@ int sys_sigaction(int signum, + + #endif // defined(MEMORY_SANITIZER) + ++SANDBOX_EXPORT int sys_fstat64(int fd, struct stat64 *buf) ++{ ++#if defined(__NR_fstat64) ++ return syscall(__NR_fstat64, fd, buf); ++#else ++ return syscall(__NR_fstat, fd, buf); ++#endif ++} ++ + } // namespace sandbox +diff -up chromium-88.0.4324.96/sandbox/linux/services/syscall_wrappers.h.fstatfix chromium-88.0.4324.96/sandbox/linux/services/syscall_wrappers.h +--- chromium-88.0.4324.96/sandbox/linux/services/syscall_wrappers.h.fstatfix 2021-01-25 10:19:53.115379741 -0500 ++++ chromium-88.0.4324.96/sandbox/linux/services/syscall_wrappers.h 2021-01-25 10:20:45.485588421 -0500 +@@ -17,6 +17,7 @@ struct sock_fprog; + struct rlimit64; + struct cap_hdr; + struct cap_data; ++struct stat64; + + namespace sandbox { + +@@ -84,6 +85,9 @@ SANDBOX_EXPORT int sys_sigaction(int sig + const struct sigaction* act, + struct sigaction* oldact); + ++// Recent glibc rewrites fstat to fstatat. ++SANDBOX_EXPORT int sys_fstat64(int fd, struct stat64 *buf); ++ + } // namespace sandbox + + #endif // SANDBOX_LINUX_SERVICES_SYSCALL_WRAPPERS_H_ diff --git a/chromium.spec b/chromium.spec index fca2869f..5ce96151 100644 --- a/chromium.spec +++ b/chromium.spec @@ -210,7 +210,7 @@ Name: chromium%{chromium_channel}%{nsuffix} Name: chromium%{chromium_channel} %endif Version: %{majorversion}.0.4324.96 -Release: 1%{?dist} +Release: 2%{?dist} %if %{?freeworld} %if %{?shared} # chromium-libs-media-freeworld @@ -304,6 +304,9 @@ Patch72: chromium-88-federated_learning-include.patch Patch73: chromium-88-ityp-include.patch # https://github.com/stha09/chromium-patches/blob/master/chromium-88-StringPool-include.patch Patch74: chromium-88-StringPool-include.patch +# Fix sandbox code to properly handle the new way that glibc handles fstat in Fedora 34+ +# Thanks to Kevin Kofler for the fix. +Patch75: chromium-88.0.4324.96-fstatfix.patch # Use lstdc++ on EPEL7 only Patch101: chromium-75.0.3770.100-epel7-stdc++.patch @@ -928,6 +931,7 @@ udev. %patch72 -p1 -b .federated_learning-include %patch73 -p1 -b .ityp-include %patch74 -p1 -b .StringPool-include +%patch75 -p1 -b .fstatfix # Fedora branded user agent %if 0%{?fedora} @@ -1971,6 +1975,9 @@ getent group chrome-remote-desktop >/dev/null || groupadd -r chrome-remote-deskt %changelog +* Mon Jan 25 2021 Tom Callaway - 88.0.4324.96-2 +- apply fix from Kevin Kofler for new glibc fstat sandbox handling + * Wed Jan 20 2021 Tom Callaway - 88.0.4324.96-1 - 88 goes from beta to stable - disable use of api keys (Google shut off API access) From a9bcc194060cd428f5b7efdbb605b0f924869ada Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Tue, 26 Jan 2021 01:56:54 +0000 Subject: [PATCH 2/4] - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- chromium.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/chromium.spec b/chromium.spec index 5ce96151..1bee5b5d 100644 --- a/chromium.spec +++ b/chromium.spec @@ -210,7 +210,7 @@ Name: chromium%{chromium_channel}%{nsuffix} Name: chromium%{chromium_channel} %endif Version: %{majorversion}.0.4324.96 -Release: 2%{?dist} +Release: 3%{?dist} %if %{?freeworld} %if %{?shared} # chromium-libs-media-freeworld @@ -1975,6 +1975,9 @@ getent group chrome-remote-desktop >/dev/null || groupadd -r chrome-remote-deskt %changelog +* Tue Jan 26 2021 Fedora Release Engineering - 88.0.4324.96-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + * Mon Jan 25 2021 Tom Callaway - 88.0.4324.96-2 - apply fix from Kevin Kofler for new glibc fstat sandbox handling From acf081f1d3990da5dccc231dd57c1b65b30bf560 Mon Sep 17 00:00:00 2001 From: Tom spot Callaway Date: Tue, 2 Feb 2021 12:19:56 -0500 Subject: [PATCH 3/4] turn on the API key (just the API key, not the client_id or client_secret) --- chromium.spec | 28 ++++++++++++++++++++-------- 1 file changed, 20 insertions(+), 8 deletions(-) diff --git a/chromium.spec b/chromium.spec index 1bee5b5d..4c9654f9 100644 --- a/chromium.spec +++ b/chromium.spec @@ -65,7 +65,9 @@ %endif # Disabled because of Google, starting with Chromium 88. -%global useapikeys 0 +%global userestrictedapikeys 0 +# We can still use the api key though. For now. +%global useapikey 1 # Leave this alone, please. %global builddir out/Release @@ -176,8 +178,8 @@ BuildRequires: libicu-devel >= 5.4 ### From 2013 until early 2021, Google permitted distribution builds of ### Chromium to access Google APIs that added significant features to ### Chromium including, but not limited to, Sync and geolocation. -### As of March 15, 2021, any Chromium builds which pass API keys -### during build will prevent end-users from signing into their +### As of March 15, 2021, any Chromium builds which pass client_id and/or +### client_secret during build will prevent end-users from signing into their ### Google account. ### With Chromium 88, I have removed the calls to "google_default_client_id" @@ -190,13 +192,17 @@ BuildRequires: libicu-devel >= 5.4 ### Note: These are for Fedora use ONLY. ### For your own distribution, please get your own set of keys. ### http://lists.debian.org/debian-legal/2013/11/msg00006.html -%if %{useapikeys} +%if %{useapikey} %global api_key AIzaSyDUIXvzVrt5OkVsgXhQ6NFfvWlA44by-aw +%else +%global api_key %nil +%endif + +%if %{userestrictedapikeys} %global default_client_id 449907151817.apps.googleusercontent.com %global default_client_secret miEreAep8nuvTdvLums6qyLK %global chromoting_client_id 449907151817-8vnlfih032ni8c4jjps9int9t86k546t.apps.googleusercontent.com %else -%global api_key %nil %global default_client_id %nil %global default_client_secret %nil %global chromoting_client_id %nil @@ -210,7 +216,7 @@ Name: chromium%{chromium_channel}%{nsuffix} Name: chromium%{chromium_channel} %endif Version: %{majorversion}.0.4324.96 -Release: 3%{?dist} +Release: 4%{?dist} %if %{?freeworld} %if %{?shared} # chromium-libs-media-freeworld @@ -1058,8 +1064,11 @@ CHROMIUM_CORE_GN_DEFINES+=' is_debug=false' %ifarch x86_64 aarch64 CHROMIUM_CORE_GN_DEFINES+=' system_libdir="lib64"' %endif -%if %{useapikeys} -CHROMIUM_CORE_GN_DEFINES+=' google_api_key="%{api_key}" google_default_client_id="%{default_client_id}" google_default_client_secret="%{default_client_secret}"' +%if %{useapikey} +CHROMIUM_CORE_GN_DEFINES+=' google_api_key="%{api_key}"' +%endif +%if %{userestrictedapikeys} +CHROMIUM_CORE_GN_DEFINES+=' google_default_client_id="%{default_client_id}" google_default_client_secret="%{default_client_secret}"' %endif CHROMIUM_CORE_GN_DEFINES+=' is_clang=false use_sysroot=false fieldtrial_testing_like_official_build=true use_lld=false rtc_enable_symbol_export=true' %if %{use_gold} @@ -1975,6 +1984,9 @@ getent group chrome-remote-desktop >/dev/null || groupadd -r chrome-remote-deskt %changelog +* Tue Feb 2 2021 Tom Callaway - 88.0.4234.96-4 +- turn on the API key (just the API key, not the client_id or client_secret) + * Tue Jan 26 2021 Fedora Release Engineering - 88.0.4324.96-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild From e5f24f4877f251e3ae5e86c03c9cd7ecbaa8d94a Mon Sep 17 00:00:00 2001 From: Tom spot Callaway Date: Tue, 2 Feb 2021 18:49:03 -0500 Subject: [PATCH 4/4] 88.0.4234.146 --- chromium.spec | 7 +++++-- sources | 2 +- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/chromium.spec b/chromium.spec index 4c9654f9..e7051da4 100644 --- a/chromium.spec +++ b/chromium.spec @@ -215,8 +215,8 @@ Name: chromium%{chromium_channel}%{nsuffix} %else Name: chromium%{chromium_channel} %endif -Version: %{majorversion}.0.4324.96 -Release: 4%{?dist} +Version: %{majorversion}.0.4324.146 +Release: 1%{?dist} %if %{?freeworld} %if %{?shared} # chromium-libs-media-freeworld @@ -1984,6 +1984,9 @@ getent group chrome-remote-desktop >/dev/null || groupadd -r chrome-remote-deskt %changelog +* Tue Feb 2 2021 Tom Callaway - 88.0.4234.146-1 +- update to 88.0.4234.146 + * Tue Feb 2 2021 Tom Callaway - 88.0.4234.96-4 - turn on the API key (just the API key, not the client_id or client_secret) diff --git a/sources b/sources index 3a9c3c85..cc3c70c7 100644 --- a/sources +++ b/sources @@ -20,4 +20,4 @@ SHA512 (xcb-proto-1.14.tar.xz) = de66d568163b6da2be9d6c59984f3afa3acd119a7813786 SHA512 (depot_tools.git-master.tar.gz) = dc323888812b66cc92c53a24a8a58ccf9e2961be67aa21852bd091b8b49569071f06ae9104cb58950e6253ac3a29f0db0663e9f35ef2b1ea28696efb38b42708 SHA512 (NotoSansSymbols2-Regular.ttf) = 2644b42c3fdccfe12395f9b61553aced169a0f1dc09f5a0fd7898e9d0a372ee4422b6b1cdab3c86ecc91db437e9ae8a951e64e85edc3ac9e9fca428852dbb2ad SHA512 (NotoSansTibetan-Regular.ttf) = fb5a48fcaea80eebe7d692f6fcf00d59d47658a358d0ec8e046fc559873f88bd595b2da474d2826abd9e9305f3741c69058d867b1e6048f37fe7d71b5d3af36a -SHA512 (chromium-88.0.4324.96-clean.tar.xz) = 973d1e130039835361b49b2acadb9e6d54ce49ab391369f7922518941ff9f77097ac74637d4c1773b4c65d3a40e9a95a6b87ea0dcec42016fbb16bf5b6b98fde +SHA512 (chromium-88.0.4324.146-clean.tar.xz) = c868cf5e5f7c9e156f6c7899f50d37641298c34e5fcc2ee2087b668f0cb27fd6d289e7588de4b15875f41c7ef966028f832ab8625f8028b4d7532893a970ed47