983518 - Homescreen sandbox crash on QRD kitkat

Status: RESOLVED FIXED

(Core :: Security, defect)

Description

[Paul Theriault [:pauljt] (no longer reading bugmail)]

Mvines report that homescreen is crashing with a sandbox error on kitkat. We need to jump on this asap. 

For the KK baseline (i.e., the real v1.4 baseline) , the homescreen gets
killed at boot with a:
	E/Sandbox ( 1241): seccomp sandbox violation: pid 1241, syscall 186, args
3005218204 0 0 3 4308040 0.  Killing process.

Bug can be reproduced using this build:
https://bug961246.bugzilla.mozilla.org/attachment.cgi?id=8381550&t=VRMWJg37

Comment 1

[Michael Vines [:m1] [:evilmachines]]

Also enable these configs in arch/arm/configs/msm8226_defconfig first of course:
+CONFIG_SECCOMP=y
+CONFIG_SECCOMP_FILTER=y

Comment 2

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

(In reply to Paul Theriault [:pauljt] from comment #0)
> 	E/Sandbox ( 1241): seccomp sandbox violation: pid 1241, syscall 186, args 3005218204

sigaltstack.  It should be reasonably safe to whitelist it.  I'm curious what the call stack is, though.

Comment 3

[Michael Vines [:m1] [:evilmachines]]

https://www.codeaurora.org/cgit/quic/la/platform/bionic/tree/libc/bionic/pthread_create.cpp?id=d3e32648689e22569dfe45f77bceb358042914fc#n71

---
Crash reason:  SIGSYS
Crash address: 0xb6f4e3cc

Thread 14 (crashed)
 0  libc.so + 0x203cc
     r4 = 0x00a04c48    r5 = 0x00000000    r6 = 0xb5395fe9    r7 = 0x000000ba
     r8 = 0xb5395fe9    r9 = 0xb3202000   r10 = 0xbec812ec    fp = 0xb6f7a2ec
     sp = 0xb32ffd90    lr = 0xb6f3b1b8    pc = 0xb6f4e3cc
    Found by: given as instruction pointer in context
 1  libc.so!__thread_entry [pthread_create.cpp : 99 + 0x6]
     sp = 0xb32ffdb8    pc = 0xb6f3b200
    Found by: stack scanning
 2  libc.so!pthread_create [pthread_create.cpp : 224 + 0x16]
     r4 = 0x00a04c48    r5 = 0xb32ffdd0    r6 = 0x0000000b    r7 = 0x00000078
     sp = 0xb32ffdd0    pc = 0xb6f3b3b4
    Found by: call frame info

Comment 4

[Guillaume Destuynder [:kang] [this account is no longer active]]

Attachment: sigal.patch

Reproduced on AU_LINUX_GECKO_B2G_KK_3.5.01.04.00.113 and AU_LINUX_GECKO_B2G_KK_3.5.01.04.00.113.025

Whitelisting the syscall sigaltstack solves it. This stuff is used to keep the signal state in the 'main' stack while handling debugging signals in the alternate stack.

Try: https://tbpl.mozilla.org/?tree=Try&rev=d11b8f4947f1

Comment 5

[Guillaume Destuynder [:kang] [this account is no longer active]]

Comment on attachment 8391546 [details] [diff] [review]
sigal.patch

Review of attachment 8391546 [details] [diff] [review]:
-----------------------------------------------------------------

I'm tired. wrong reviewer.

Comment 6

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Comment on attachment 8391546 [details] [diff] [review]
sigal.patch

Review of attachment 8391546 [details] [diff] [review]:
-----------------------------------------------------------------

::: security/sandbox/linux/seccomp_filter.h
@@ +139,5 @@
>    ALLOW_SYSCALL(epoll_ctl), \
>    ALLOW_SYSCALL(sched_yield), \
>    ALLOW_SYSCALL(sched_getscheduler), \
> +  ALLOW_SYSCALL(sched_setscheduler), \
> +  ALLOW_SYSCALL(sigalstack),

"sigaltstack", with a "t".

Comment 7

[Guillaume Destuynder [:kang] [this account is no longer active]]

Attachment: sigalt.patch

https://tbpl.mozilla.org/?tree=Try&rev=2667b05fe138

Comment 8

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/32895b78c93c