[chromium-freeworld] Another sandbox fix
commit 970e263a483e402b55c8cc29497fadadbd4578c8
Author: Leigh Scott <leigh123linux(a)gmail.com>
Date: Wed Aug 25 18:09:00 2021 +0100
Another sandbox fix
chromium-freeworld.spec | 1 +
chromium-sandbox-clone3.patch | 16 ++++++++++++++++
2 files changed, 17 insertions(+)
---
diff --git a/chromium-freeworld.spec b/chromium-freeworld.spec
index 56c662f..14a64b7 100644
--- a/chromium-freeworld.spec
+++ b/chromium-freeworld.spec
@@ -160,6 +160,7 @@ Patch301: chromium-gcc11.patch
Patch302: chromium-py3-fixes.patch
Patch303: chromium-java-only-allowed-in-android-builds.patch
Patch304: chromium-freetype-2.11.patch
+Patch305: chromium-sandbox-clone3.patch
Patch1303: chromium-rawhide-gcc-std-max-fix.patch
# RPM Fusion patches [free/chromium-freeworld]:
diff --git a/chromium-sandbox-clone3.patch b/chromium-sandbox-clone3.patch
new file mode 100644
index 0000000..a439935
--- /dev/null
+++ b/chromium-sandbox-clone3.patch
@@ -0,0 +1,16 @@
+diff -up
chromium-92.0.4515.107/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc.clone3
chromium-92.0.4515.107/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
+---
chromium-92.0.4515.107/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc.clone3 2021-08-16
09:05:35.836277326 -0400
++++
chromium-92.0.4515.107/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc 2021-08-16
09:06:17.420502628 -0400
+@@ -178,6 +178,12 @@ ResultExpr EvaluateSyscallImpl(int fs_de
+ return RestrictCloneToThreadsAndEPERMFork();
+ }
+
++ // clone3 takes a pointer argument which we cannot examine, so return ENOSYS
++ // to force the libc to use clone. See https://crbug.com/1213452.
++ if (sysno == __NR_clone3) {
++ return Error(ENOSYS);
++ }
++
+ if (sysno == __NR_fcntl)
+ return RestrictFcntlCommands();
+