Bug 27234 - After starting a plasma5 session, ~/.config/gtk-3.0 is altered and causes firefox to emit seccomp sandbox violation errors (and tab crashes with Nightly) [glib2.0 regression]
Summary: After starting a plasma5 session, ~/.config/gtk-3.0 is altered and causes fir...
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: Cauldron
Hardware: x86_64 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: Base system maintainers
QA Contact:
URL: https://shlom.in/
Whiteboard:
Keywords: UPSTREAM
Depends on:
Blocks:
 
Reported: 2020-09-01 10:53 CEST by Shlomi Fish
Modified: 2020-09-03 11:24 CEST (History)
8 users (show)

See Also:
Source RPM: glib2.0-2.65.2-1.mga8
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Shlomi Fish 2020-09-01 10:53:48 CEST 
Description of problem:

After starting a plasma5 session, ~/.config/gtk-3.0 is altered and causes firefox to emit many warnings on the terminal. I am getting this:

```
Sandbox: unsupported fd-relative fstatat(45, "", 0x7FFDCD76AED0, 4096)
Sandbox: seccomp sandbox violation: pid 1731106, tid 1731106, syscall 262, args 45 139750230303095 140728050560720 4096 4096 1.
Sandbox: unsupported fd-relative fstatat(45, "", 0x7FFDCD76ADE0, 4096)
Sandbox: seccomp sandbox violation: pid 1731106, tid 1731106, syscall 262, args 45 139750230303095 140728050560480 4096 4096 1.
Sandbox: unsupported flags 2048 in fstatat(-100, "/home/shlomif/.config/gtk-3.0/colors.css", 0x7F1A0B0FD960, 2304)
Sandbox: seccomp sandbox violation: pid 1731106, tid 1731142, syscall 262, args 4294967196 139749837723584 139749831465312 2304 2304 1.
Sandbox: unsupported fd-relative fstatat(22, "", 0x7FFE7B82AD60, 4096)
Sandbox: seccomp sandbox violation: pid 1731159, tid 1731159, syscall 262, args 22 140351292215671 140730970582368 4096 4096 1.
Sandbox: unsupported fd-relative fstatat(22, "", 0x7FFE7B82AC70, 4096)
Sandbox: seccomp sandbox violation: pid 1731159, tid 1731159, syscall 262, args 22 140351292215671 140730970582128 4096 4096 1.
Sandbox: unsupported flags 2048 in fstatat(-100, "/home/shlomif/.config/gtk-3.0/colors.css", 0x7FA5FD1FD960, 2304)
Sandbox: seccomp sandbox violation: pid 1731159, tid 1731188, syscall 262, args 4294967196 140350902546000 140350893054304 2304 2304 1.
Sandbox: unsupported flags 2048 in fstatat(-100, "/home/shlomif/.config/gtk-3.0/colors.css", 0x7F1A0B0FD960, 2304)
Sandbox: seccomp sandbox violation: pid 1731106, tid 1731142, syscall 262, args 4294967196 139749837723584 139749831465312 2304 2304 1.
Sandbox: unsupported flags 2048 in fstatat(-100, "/home/shlomif/.config/gtk-3.0/colors.css", 0x7FA5FD1FD960, 2304)
Sandbox: seccomp sandbox violation: pid 1731159, tid 1731188, syscall 262, args 4294967196 140350902546000 140350893054304 2304 2304 1.
Sandbox: unsupported flags 2048 in fstatat(-100, "/home/shlomif/.config/gtk-3.0/colors.css", 0x7F1A0B0FD960, 2304)
Sandbox: seccomp sandbox violation: pid 1731106, tid 1731142, syscall 262, args 4294967196 139749837723584 139749831465312 2304 2304 1.
Sandbox: unsupported flags 2048 in fstatat(-100, "/home/shlomif/.config/gtk-3.0/colors.css", 0x7FA5FD1FD960, 2304)
Sandbox: seccomp sandbox violation: pid 1731159, tid 1731188, syscall 262, args 4294967196 140350902546000 140350893054304 2304 2304 1.
Sandbox: unsupported flags 2048 in fstatat(-100, "/home/shlomif/.config/gtk-3.0/colors.css", 0x7F1A0B0FD960, 2304)
Sandbox: seccomp sandbox violation: pid 1731106, tid 1731142, syscall 262, args 4294967196 139749837723584 139749831465312 2304 2304 1.
Sandbox: unsupported flags 2048 in fstatat(-100, "/home/shlomif/.config/gtk-3.0/colors.css", 0x7FA5FD1FD960, 2304)
Sandbox: seccomp sandbox violation: pid 1731159, tid 1731188, syscall 262, args 4294967196 140350902546000 140350893054304 2304 2304 1.
Sandbox: unsupported flags 2048 in fstatat(-100, "/home/shlomif/.config/gtk-3.0/colors.css", 0x7F1A0B0FD960, 2304)
Sandbox: seccomp sandbox violation: pid 1731106, tid 1731142, syscall 262, args 4294967196 139749837723584 139749831465312 2304 2304 1.
Sandbox: unsupported flags 2048 in fstatat(-100, "/home/shlomif/.config/gtk-3.0/colors.css", 0x7FA5FD1FD960, 2304)
Sandbox: seccomp sandbox violation: pid 1731159, tid 1731188, syscall 262, args 4294967196 140350902546000 140350893054304 2304 2304 1.
Sandbox: unsupported flags 2048 in fstatat(-100, "/home/shlomif/.config/gtk-3.0/colors.css", 0x7F1A0B0FD960, 2304)
Sandbox: seccomp sandbox violation: pid 1731106, tid 1731142, syscall 262, args 4294967196 139749837723584 139749831465312 2304 2304 1.
Sandbox: unsupported flags 2048 in fstatat(-100, "/home/shlomif/.config/gtk-3.0/colors.css", 0x7FA5FD1FD960, 2304)
Sandbox: seccomp sandbox violation: pid 1731159, tid 1731188, syscall 262, args 4294967196 140350902546000 140350893054304 2304 2304 1.
Sandbox: unsupported flags 2048 in fstatat(-100, "/home/shlomif/.config/gtk-3.0/colors.css", 0x7F1A0B0FD960, 2304)
Sandbox: seccomp sandbox violation: pid 1731106, tid 1731142, syscall 262, args 4294967196 139749837723584 139749831465312 2304 2304 1.
Sandbox: unsupported flags 2048 in fstatat(-100, "/home/shlomif/.config/gtk-3.0/colors.css", 0x7FA5FD1FD960, 2304)
Sandbox: seccomp sandbox violation: pid 1731159, tid 1731188, syscall 262, args 4294967196 140350902546000 140350893054304 2304 2304 1.
Sandbox: unsupported flags 2048 in fstatat(-100, "/home/shlomif/.config/gtk-3.0/colors.css", 0x7F1A0B0FD960, 2304)
Sandbox: seccomp sandbox violation: pid 1731106, tid 1731142, syscall 262, args 4294967196 139749837723584 139749831465312 2304 2304 1.
Sandbox: unsupported flags 2048 in fstatat(-100, "/home/shlomif/.config/gtk-3.0/colors.css", 0x7FA5FD1FD960, 2304)
Sandbox: seccomp sandbox violation: pid 1731159, tid 1731188, syscall 262, args 4294967196 140350902546000 140350893054304 2304 2304 1.
Sandbox: unsupported flags 2048 in fstatat(-100, "/home/shlomif/.config/gtk-3.0/colors.css", 0x7F1A0B0FD960, 2304)
Sandbox: seccomp sandbox violation: pid 1731106, tid 1731142, syscall 262, args 4294967196 139749837723584 139749831465312 2304 2304 1.
Sandbox: unsupported flags 2048 in fstatat(-100, "/home/shlomif/.config/gtk-3.0/colors.css", 0x7FA5FD1FD960, 2304)
Sandbox: seccomp sandbox violation: pid 1731159, tid 1731188, syscall 262, args 4294967196 140350902546000 140350893054304 2304 2304 1.
Sandbox: unsupported flags 2048 in fstatat(-100, "/home/shlomif/.config/gtk-3.0/colors.css", 0x7F1A0B0FD960, 2304)
Sandbox: seccomp sandbox violation: pid 1731106, tid 1731142, syscall 262, args 4294967196 139749837723584 139749831465312 2304 2304 1.
Sandbox: unsupported flags 2048 in fstatat(-100, "/home/shlomif/.config/gtk-3.0/colors.css", 0x7FA5FD1FD960, 2304)
Sandbox: seccomp sandbox violation: pid 1731159, tid 1731188, syscall 262, args 4294967196 140350902546000 140350893054304 2304 2304 1.
Sandbox: unsupported flags 2048 in fstatat(-100, "/home/shlomif/.config/gtk-3.0/colors.css", 0x7F1A0B0FD960, 2304)
Sandbox: seccomp sandbox violation: pid 1731106, tid 1731142, syscall 262, args 4294967196 139749837723584 139749831465312 2304 2304 1.
Sandbox: unsupported flags 2048 in fstatat(-100, "/home/shlomif/.config/gtk-3.0/colors.css", 0x7FA5FD1FD960, 2304)
Sandbox: seccomp sandbox violation: pid 1731159, tid 1731188, syscall 262, args 4294967196 140350902546000 140350893054304 2304 2304 1.

```

The problem can be fixed by renaming `~/.config/gtk-3.0` and happens with both /usr/bin/firefox and mozilla.org's ESR firefox.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1. start a plasma session
2. run "firefox" from konsole.
3.
Comment 1 Rémi Verschelde 2020-09-01 12:38:36 CEST 
According to pterjan:

> This is most likely due to glibc update, probably seccomp needs to be
> updated for it

I can reproduce the seccomp errors, and they lead to systematic crashing on tabs on Firefox Nightly (and Chromium).

Assignee: bugsquad => kde
CC: (none) => basesystem, rverschelde

Comment 2 Rémi Verschelde 2020-09-01 12:46:11 CEST 
For the reference, we seem to have the latest libseccomp including a backport of a patch fixing a serious issue (which Neal was involved in for Fedora): https://github.com/seccomp/libseccomp/issues/273

I'll see if packaging libssecomp 2.4.4 locally (i.e. a downgrade to the previous stable branch) alleviates this new issue.

CC: (none) => ngompa13

Comment 3 Rémi Verschelde 2020-09-01 16:43:07 CEST 
(In reply to Rémi Verschelde from comment #2)
> 
> I'll see if packaging libssecomp 2.4.4 locally (i.e. a downgrade to the
> previous stable branch) alleviates this new issue.

It does not, I downgraded to libseccomp 2.4.3 from the earlier SVN revision of our package, and I still get the same issue.

Firefox tab crash backtrace (I installed debuginfo for glib2.0 and gio2.0 but it doesn't help):
```
Sandbox: Sandbox: unsupported flags 2048 in fstatat(-100, "/home/akien/.config/gtk-3.0/colors.css", 0x7F94F9903960, 2304)
unsupported flags 2048 in fstatat(-100, "/home/akien/.config/gtk-3.0/colors.css", 0x7F95007FD960, 2304)
Sandbox: seccomp sandbox violation: pid 59290, tid 59297, syscall 262, args 4294967196 140277938373680 140277935233376 2304 2304 1.  Killing process.
Sandbox: seccomp sandbox violation: pid 59290, tid 61591, syscall 262, args 4294967196 140277936453376 140277818866016 2304 2304 1.  Killing process.
Sandbox: crash reporter is disabled (or failed); trying stack trace:
Sandbox: frame #01: __fxstatat64[/lib64/libc.so.6 +0xe739b]
Sandbox: frame #02: ???[/lib64/libc.so.6 +0xe6fcc]
Sandbox: frame #03: ???[/lib64/libgio-2.0.so.0 +0x1316da]
Sandbox: frame #04: ???[/lib64/libgio-2.0.so.0 +0x12d1a7]
Sandbox: frame #05: ???[/lib64/libgio-2.0.so.0 +0x600cc]
Sandbox: frame #06: ???[/lib64/libgio-2.0.so.0 +0xaf0ee]
Sandbox: frame #07: ???[/lib64/libglib-2.0.so.0 +0x792b4]
Sandbox: frame #08: ???[/lib64/libglib-2.0.so.0 +0x789ee]
Sandbox: frame #09: ???[/lib64/libpthread.so.0 +0x8df0]
Sandbox: frame #10: clone[/lib64/libc.so.6 +0xf622f]
Sandbox: frame #11: ??? (???:???)
Sandbox: end of stack.
```
Comment 4 Pascal Terjan 2020-09-01 17:00:46 CEST 
I would think the problem is more the sandboxes not reacting nicely when they get rejected due to that syscall having unexpected parameter, and the list of parameters accepted by seccomp for those apps should be updated.

The reason this happens is likely a change in kernel (which would advertise a feature causing the apps to start using the parameter) or in glibc which would start using that syscall differently, and only glibc was upgraded recently. It could also be another library directly issuing the syscalls, or passing a flag that then get passed through by glibc.

It is complaining about the 2048 bit which seems to be AT_STATX_DONT_SYNC so something started setting that flag or maybe started using fstatat altogether.

CC: (none) => pterjan

Comment 5 Pascal Terjan 2020-09-01 18:09:44 CEST 
It would be great to get a stacktrace wirh gio debuginfo, the change may be in gio. It seems glib 2.65.2 added some statx support.
Comment 6 Pascal Terjan 2020-09-01 21:29:29 CEST 
Also, as the problem happens when it looks at ~/.config/gtk-3.0/colors.css created by kde and used from an @include in ~/.config/gtk-3.0/gtk.css, commenting that include should workaround the problem at the cost of gtk apps not following kde colours.
Comment 7 Pascal Terjan 2020-09-01 21:59:31 CEST 
So it seems firefox only allows AT_SYMLINK_NOFOLLOW:

https://hg.mozilla.org/mozilla-central/file/tip/security/sandbox/linux/SandboxFilter.cpp#l257

And it gets upset when gtk passes more flags...
Comment 8 Rémi Verschelde 2020-09-02 09:29:07 CEST 
(In reply to Pascal Terjan from comment #5)
> It would be great to get a stacktrace wirh gio debuginfo, the change may be
> in gio. It seems glib 2.65.2 added some statx support.

I installed glib2.0 and gio2.0 debuginfo, but Firefox's crash handler doesn't seem to be able to pick them up.

I even tried https://developer.mozilla.org/en-US/docs/Mozilla/Using_the_Mozilla_symbol_server but that doesn't improve the stack trace.

(In reply to Pascal Terjan from comment #7)
> So it seems firefox only allows AT_SYMLINK_NOFOLLOW:
> 
> https://hg.mozilla.org/mozilla-central/file/tip/security/sandbox/linux/
> SandboxFilter.cpp#l257
> 
> And it gets upset when gtk passes more flags...

I guess we should report this to https://gitlab.gnome.org/GNOME/glib and/or https://bugzilla.mozilla.org?

BTW, are others able to reproduce the issue too? I also get it on a second laptop running the same setup (Mageia 8 + Plasma + Firefox Nightly).
Comment 9 Giuseppe Ghibò 2020-09-02 11:32:09 CEST 
Latest glibc patch IIRC was prior to this plasma change, and the only change regarding syscall was this: 

http://svnweb.mageia.org/packages/cauldron/glibc/current/SOURCES/0250-nptl-Zero-extend-arguments-to-SETXID-syscalls-BZ-262.patch?revision=1611995&view=markup

which doesn't seem advertising a new kernel feature.

Can you try downgrade either glibc (or other components) and/or boot with kernel 5.7 (if you add belnet.be to the mirror list it should have all the old versions packages, so you can downgrade packages easily by hand) to see if that would help?

Speaking of syscall advertising of new features of kernel 5.8, there are two new patches in master trunk (which is for glibc 2.32/33 not 2.31):

https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=1cfb4715288845ebc55ad664421b48b32de9599c

and

https://sourceware.org/git/?p=glibc.git;a=commit;h=42a00a0fb4c69d940ac5f6b08a57e045e14f22f7

AFAIK our glibc 2.31 version has all the kernel features up to 5.4 (see for instance file sysdeps/unix/sysv/linux/tst-mman-consts.py or scripts/build-many-glibcs.py).

CC: (none) => ghibomgx

Comment 10 Pascal Terjan 2020-09-02 12:32:18 CEST 
Yes it seems to be a problem between firefox being very restrictive with allowed flags (comment #7) and glib now using statx.
Rémi Verschelde 2020-09-02 13:34:18 CEST

Summary: After starting a plasma5 session, ~/.config/gtk-3.0 is altered and causes firefox to emit many warnings on the terminal => After starting a plasma5 session, ~/.config/gtk-3.0 is altered and causes firefox to emit seccomp sandbox violation errors (and tab crashes with Nightly)

Comment 11 Rémi Verschelde 2020-09-02 14:20:10 CEST 
I built 64-bit and 32-bit glib2.0-2.65.0-2.mga8 with mock (packages SVN r1609965) and downgraded all installed glib/gio packages, and I can confirm that it seems to solve the issue (after restoring a "broken" ~/.config/gtk-3.0 and restarting Firefox Nightly).

Then re-upgrading to glib2.0-2.65.2-1.mga8 triggers the issue anew after restarting Firefox Nightly.

Source RPM: plasma-workspace-5.19.4-2.mga8.src.rpm => glib2.0-2.65.2-1.mga8
Summary: After starting a plasma5 session, ~/.config/gtk-3.0 is altered and causes firefox to emit seccomp sandbox violation errors (and tab crashes with Nightly) => After starting a plasma5 session, ~/.config/gtk-3.0 is altered and causes firefox to emit seccomp sandbox violation errors (and tab crashes with Nightly) [glib2.0 regression]
CC: (none) => thierry.vignaud

Comment 12 Rémi Verschelde 2020-09-02 14:34:38 CEST 
I filed a bug report upstream: https://gitlab.gnome.org/GNOME/glib/-/issues/2198

Assignee: kde => basesystem
Keywords: (none) => UPSTREAM
CC: (none) => gnome, kde
See Also: (none) => https://gitlab.gnome.org/GNOME/glib/-/issues/2198

Comment 13 Rémi Verschelde 2020-09-02 15:07:19 CEST 
Given that the upstream bug report was closed as "not our responsibility", and it's even less ours, I suggest that we revert glib to the stable branch (2.64.5).

We'll have to wait for glib, Mozilla and Google to work together on how to update the sandboxing situation before we can consider shipping 2.65.2 or later.
Comment 14 Giuseppe Ghibò 2020-09-02 15:29:06 CEST 
Since we narrowed the problem to glib2.0, waiting for some move on chromium/firefox, which was the latest glib2.0 working? 2.65.0 works? As an alternative to entire downgrading to 2.64.5, we can temporarely just revert the statx change in glib2.0 to its previous state and go on. This one seems the latest change involving statx:

https://gitlab.gnome.org/GNOME/glib/-/commit/6fc143bba81a02cac0ca6bc47e8249b65ffc0ad9)

we can try to see if reverting that patch fixes the problem (though probably would remain prone to this: https://gitlab.gnome.org/GNOME/glib/-/issues/2189, but I guess glib 2.64.x would be too).
Comment 15 Giuseppe Ghibò 2020-09-02 15:31:23 CEST 
Well, yes 2.65.0 you said it was working.
Comment 16 Rémi Verschelde 2020-09-02 15:38:21 CEST 
(In reply to Giuseppe Ghibò from comment #15)
> Well, yes 2.65.0 you said it was working.

Personally, given how upstream handles report about issues created by the dev releases, I'd prefer that we go back to stable (2.64.5).
Comment 17 Giuseppe Ghibò 2020-09-02 15:48:07 CEST 
Looking at reverting that patch, I noticed that we use that patch on 2.65.2 on purpose for fixing glib bug #2189, see:

http://svnweb.mageia.org/packages/cauldron/glib2.0/current/SOURCES/0001-gio-
Allow-no-atime-from-statx.patch?view=log

Maybe just removing that patch could help (probably 2.64.5 is affected too), waiting for chrome/firefox reaction on final glib2.0 release. We could try.
Comment 18 Rémi Verschelde 2020-09-03 10:42:13 CEST 
Fixed in glib2.0-2.65.2-2.mga8 by commenting out `HAVE_STATX` in `meson.build` as suggested by Christiaan Welwaart on the dev ML.

http://svnweb.mageia.org/packages/cauldron/glib2.0/current/SPECS/glib2.0.spec?r1=1619697&r2=1621246&pathrev=1621247

Resolution: (none) => FIXED
Status: NEW => RESOLVED

Comment 19 Thierry Vignaud 2020-09-03 11:00:56 CEST 
Nice catch!
Though now, it would be nice if upstream could update the allowlist to include statx
Comment 20 Rémi Verschelde 2020-09-03 11:24:33 CEST 
(In reply to Thierry Vignaud from comment #19)
> Though now, it would be nice if upstream could update the allowlist to
> include statx

Yeah definitely.

Someone(TM) needs to file bug reports with Firefox and Chromium to let them know of the sandboxing violation with glib 2.65.2+.

Given that upstream GLib doesn't seem to see it as their responsibility, I guess we'll have to be the good open source citizens and do it for them...
Note You need to log in before you can comment on or make changes to this bug.