1286033 - Seccomp sandbox violation: sys_semctl called in content process of Firefox desktop

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect)

Description

[Julian Hector [:tedd] [:jhector]]

Crash reports show that sys_semctl is used in content process:

https://crash-stats.mozilla.com/search/?product=Firefox&reason=~SIGSYS&address=0x42&_sort=-date&_facets=cpu_arch&_facets=address&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#crash-reports

Comment 1

[Julian Hector [:tedd] [:jhector]]

Attachment: Add sys_semctl to seccomp whitelist and fix sys_semget. r=gcp

Try push for build: https://treeherder.mozilla.org/#/jobs?repo=try&revision=088bf7a5e5f9

Also, I fixed the issue mentioned in Bug 1285525 Comment 11 with this patch.

Comment 2

[Gian-Carlo Pascutto [:gcp]]

Underlying caller is ALSA, alsa_locked_pcm_open.

Comment 3

[Carsten Book [:Tomcat]]

failed to apply:

patching file security/sandbox/linux/SandboxFilter.cpp
Hunk #2 FAILED at 635
1 out of 2 hunks FAILED -- saving rejects to file security/sandbox/linux/SandboxFilter.cpp.rej
patch failed, unable to continue (try -v)
patch failed, rejects left in working directory
errors during apply, please fix and qrefresh semctl.patch

Comment 4

[Julian Hector [:tedd] [:jhector]]

I will rebase the patch once the other patches landed that are currently on inbound.

Comment 5

[Julian Hector [:tedd] [:jhector]]

Attachment: Add sys_semctl to seccomp whitelist and fix sys_semget. r=gcp

Carry over r+

I rebased the patch against latest inbound, hopefully it will apply cleanly now.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/dfd94f28c573
Add sys_semctl to seccomp whitelist and fix sys_semget. r=gcp

Comment 8

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/dfd94f28c573