commit f0dfab73268025786f495e5750116a14b521e3ca Author: Akarshan Biswas <akarshan.biswas(a)gmail.com&gt; Date: Fri Apr 26 07:09:43 2019 +0000 Update to 74.0.3729.108 Install missing MEIPreload component chromium-color_utils-use-std-sqrt.patch | 48 ------------- chromium-glibc-2.29.patch | 98 +++++++++++++++++++++++++++ chromium-media-fix-build-with-libstdc++.patch | 48 ------------- chromium-vaapi.spec | 32 +++++---- nounrar.patch | 13 ++-- stopVsyncspam.patch | 32 --------- 6 files changed, 124 insertions(+), 147 deletions(-) --- diff --git a/chromium-glibc-2.29.patch b/chromium-glibc-2.29.patch new file mode 100644 index 0000000..5b00aad --- /dev/null +++ b/chromium-glibc-2.29.patch @@ -0,0 +1,98 @@ +tree 0f4b37852646eae176de06a5d92cd2f68ffaf318 +parent a38dc4152f043e81310b0deff46f9a770b9f5fcb +author Matthew Denton <mpdenton(a)chromium.org&gt; 1555962368 -0700 +committer Matthew Denton <mpdenton(a)chromium.org&gt; 1555962368 -0700 + +Update Linux Seccomp syscall restrictions to EPERM posix_spawn/vfork + +Glibc's system() function switched to using posix_spawn, which uses +CLONE_VFORK. Pepperflash includes a sandbox debugging check which +relies on us EPERM-ing process creation like this, rather than crashing +the process with SIGSYS. + +So whitelist clone() calls, like posix_spawn, that include the flags +CLONE_VFORK and CLONE_VM. + +Bug: 949312 +Change-Id: I3f4b90114b2fc1d9929e3c0a85bbe8f10def3c20 + +diff --git a/sandbox/linux/seccomp-bpf-helpers/baseline_policy_unittest.cc b/sandbox/linux/seccomp-bpf-helpers/baseline_policy_unittest.cc +index cdeb210..40fcebf 100644 +--- a/sandbox/linux/seccomp-bpf-helpers/baseline_policy_unittest.cc ++++ b/sandbox/linux/seccomp-bpf-helpers/baseline_policy_unittest.cc +@@ -10,7 +10,9 @@ + #include <sched.h> + #include <signal.h> + #include <stddef.h> ++#include <stdlib.h> + #include <string.h> ++#include <sys/mman.h> + #include <sys/prctl.h> + #include <sys/resource.h> + #include <sys/socket.h> +@@ -130,6 +132,33 @@ + BPF_ASSERT_EQ(EPERM, fork_errno); + } + ++BPF_TEST_C(BaselinePolicy, SystemEperm, BaselinePolicy) { ++ errno = 0; ++ int ret_val = system("echo SHOULD NEVER RUN"); ++ BPF_ASSERT_EQ(-1, ret_val); ++ BPF_ASSERT_EQ(EPERM, errno); ++} ++ ++BPF_TEST_C(BaselinePolicy, CloneVforkEperm, BaselinePolicy) { ++ errno = 0; ++ // Allocate a couple pages for the child's stack even though the child should ++ // never start. ++ constexpr size_t kStackSize = 4096 * 4; ++ void* child_stack = mmap(nullptr, kStackSize, PROT_READ | PROT_WRITE, ++ MAP_PRIVATE | MAP_ANONYMOUS | MAP_STACK, -1, 0); ++ BPF_ASSERT_NE(child_stack, nullptr); ++ pid_t pid = syscall(__NR_clone, CLONE_VM | CLONE_VFORK | SIGCHLD, ++ static_cast<char*>(child_stack) + kStackSize, nullptr, ++ nullptr, nullptr); ++ const int clone_errno = errno; ++ TestUtils::HandlePostForkReturn(pid); ++ ++ munmap(child_stack, kStackSize); ++ ++ BPF_ASSERT_EQ(-1, pid); ++ BPF_ASSERT_EQ(EPERM, clone_errno); ++} ++ + BPF_TEST_C(BaselinePolicy, CreateThread, BaselinePolicy) { + base::Thread thread("sandbox_tests"); + BPF_ASSERT(thread.Start()); +diff --git a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc +index 100afe5..348ab6e 100644 +--- a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc ++++ b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc +@@ -135,7 +135,8 @@ + #if !defined(OS_NACL_NONSFI) + // Allow Glibc's and Android pthread creation flags, crash on any other + // thread creation attempts and EPERM attempts to use neither +-// CLONE_VM, nor CLONE_THREAD, which includes all fork() implementations. ++// CLONE_VM nor CLONE_THREAD (all fork implementations), unless CLONE_VFORK is ++// present (as in newer versions of posix_spawn). + ResultExpr RestrictCloneToThreadsAndEPERMFork() { + const Arg<unsigned long> flags(0); + +@@ -154,8 +155,16 @@ + AnyOf(flags == kAndroidCloneMask, flags == kObsoleteAndroidCloneMask, + flags == kGlibcPthreadFlags); + ++ // The following two flags are the two important flags in any vfork-emulating ++ // clone call. EPERM any clone call that contains both of them. ++ const uint64_t kImportantCloneVforkFlags = CLONE_VFORK | CLONE_VM; ++ ++ const BoolExpr is_fork_or_clone_vfork = ++ AnyOf((flags & (CLONE_VM | CLONE_THREAD)) == 0, ++ (flags & kImportantCloneVforkFlags) == kImportantCloneVforkFlags); ++ + return If(IsAndroid() ? android_test : glibc_test, Allow()) +- .ElseIf((flags & (CLONE_VM | CLONE_THREAD)) == 0, Error(EPERM)) ++ .ElseIf(is_fork_or_clone_vfork, Error(EPERM)) + .Else(CrashSIGSYSClone()); + } + diff --git a/chromium-vaapi.spec b/chromium-vaapi.spec index 484bd08..a3b4435 100644 --- a/chromium-vaapi.spec +++ b/chromium-vaapi.spec @@ -67,7 +67,7 @@ %global ozone 0 ##############################Package Definitions###################################### Name: chromium-vaapi -Version: 73.0.3683.103 +Version: 74.0.3729.108 Release: 1%{?dist} Summary: A Chromium web browser with video decoding acceleration License: BSD and LGPLv2+ and ASL 2.0 and IJG and MIT and GPLv2+ and ISC and OpenSSL and (MPLv1.1 or GPLv2 or LGPLv2) @@ -122,7 +122,7 @@ BuildRequires: pkgconfig(dbus-1), pkgconfig(libudev) BuildRequires: pkgconfig(gnome-keyring-1) BuildRequires: pkgconfig(libffi) #for vaapi -BuildRequires: pkgconfig(libva) +BuildRequires: pkgconfig(libva) %if %{ozone} BuildRequires: pkgconfig(gbm) BuildRequires: pkgconfig(wayland-client) @@ -206,11 +206,9 @@ Patch54: brand.patch #Stolen from Fedora to fix building with pipewire # https://src.fedoraproject.org/rpms/chromium/blob/master/f/chromium-73.0.3... Patch65: chromium-73.0.3683.75-pipewire-cstring-fix.patch -# Stop Vsync error spam when chromium runs on Wayland (Reviewed upstream) -Patch66: stopVsyncspam.patch -#Fix chromium color -Patch67: chromium-color_utils-use-std-sqrt.patch -Patch68: chromium-media-fix-build-with-libstdc++.patch +# Update Linux Seccomp syscall restrictions to EPERM posix_spawn/vfork +Patch66: chromium-glibc-2.29.patch + %description chromium-vaapi is an open-source web browser, powered by WebKit (Blink) ############################################PREP########################################################### @@ -227,15 +225,15 @@ chromium-vaapi is an open-source web browser, powered by WebKit (Blink) %if %{freeworld} %patch54 -p1 -b .brand %endif -#%patch64 -p1 -b .gn %if 0%{?fedora} >= 29 %patch65 -p1 -b .pipewire %endif -%patch66 -p1 -b .vsync -%patch67 -p1 -b .color -%patch68 -p1 -b .media +%patch66 -p1 -b .glibc +%if 0%{?fedora} >= 30 +# Add a workaround for a race condition in clang-llvm8+ compiler sed -i 's|const std::vector<Delta> deltas_;|std::vector<Delta> deltas_;|' chrome/browser/ui/tabs/tab_strip_model_observer.h +%endif #Let's change the default shebang of python files. find -depth -type f -writable -name "*.py" -exec sed -iE '1s=^#! */usr/bin/\(python\|env python\)[23]\?=#!%{__python2}=' {} + @@ -269,7 +267,7 @@ find -depth -type f -writable -name "*.py" -exec sed -iE '1s=^#! */usr/bin/\(pyt third_party/angle/src/third_party/compiler \ third_party/angle/src/third_party/libXNVCtrl \ third_party/angle/src/third_party/trace_event \ - third_party/angle/third_party/glslang \ + third_party/glslang \ third_party/angle/third_party/spirv-headers \ third_party/angle/third_party/spirv-tools \ third_party/angle/third_party/vulkan-headers \ @@ -302,8 +300,10 @@ find -depth -type f -writable -name "*.py" -exec sed -iE '1s=^#! */usr/bin/\(pyt third_party/crashpad/crashpad/third_party/zlib \ third_party/crc32c \ third_party/cros_system_api \ + third_party/dav1d \ third_party/devscripts \ third_party/dom_distiller_js \ + third_party/emoji-segmenter \ %if !%{with system_ffmpeg} third_party/ffmpeg \ %endif @@ -642,7 +642,7 @@ install -m 644 %{target}/v8_context_snapshot.bin %{buildroot}%{chromiumdir}/ install -m 644 %{target}/*.pak %{buildroot}%{chromiumdir}/ install -m 644 %{target}/locales/*.pak %{buildroot}%{chromiumdir}/locales/ install -m 644 %{target}/xdg* %{buildroot}%{chromiumdir}/ -install -m 644 out/Release/MEIPreload/* %{buildroot}%{chromiumdir}/MEIPreload/ +install -m 644 %{target}/MEIPreload/* %{buildroot}%{chromiumdir}/MEIPreload/ for i in 16 32; do mkdir -p %{buildroot}%{_datadir}/icons/hicolor/${i}x${i}/apps install -m 644 chrome/app/theme/default_100_percent/chromium/product_logo_$i.png \ @@ -695,6 +695,10 @@ appstream-util validate-relax --nonet "%{buildroot}%{_metainfodir}/%{name}.appda %{chromiumdir}/locales/*.pak #########################################changelogs################################################# %changelog +* Thu Apr 25 2019 Vasiliy N. Glazov <vascom2(a)gmail.com&gt; - 74.0.3729.108-1 +- Update to 74.0.3729.108 +- Install missing MEIPreload component + * Fri Apr 05 2019 Vasiliy N. Glazov <vascom2(a)gmail.com&gt; - 73.0.3683.103-1 - Update to 73.0.3683.103 @@ -823,3 +827,5 @@ appstream-util validate-relax --nonet "%{buildroot}%{_metainfodir}/%{name}.appda * Wed Aug 29 2018 Akarshan Biswas <akarshan.biswas(a)hotmail.com&gt; 68.0.3440.106-1 - Deleted provides and excludes and added conflict + + diff --git a/nounrar.patch b/nounrar.patch index 7395711..b3be4fa 100644 --- a/nounrar.patch +++ b/nounrar.patch @@ -127,13 +127,13 @@ index 158cbfc6d157..6d8b0df7c59e 100644 "sandboxed_zip_analyzer.cc", "sandboxed_zip_analyzer.h", ] -@@ -35,7 +33,6 @@ source_set("unit_tests") { +@@ -49,7 +47,6 @@ source_set("unit_tests") { - sources = [ - "sandboxed_dmg_analyzer_mac_unittest.cc", -- "sandboxed_rar_analyzer_unittest.cc", - "sandboxed_zip_analyzer_unittest.cc", - ] + sources = [ + "sandboxed_dmg_analyzer_mac_unittest.cc", +- "sandboxed_rar_analyzer_unittest.cc", + "sandboxed_zip_analyzer_unittest.cc", + ] diff --git a/chrome/services/file_util/public/mojom/safe_archive_analyzer.mojom b/chrome/services/file_util/public/mojom/safe_archive_analyzer.mojom index 266160351e18..15d5aaba3657 100644 @@ -186,3 +186,4 @@ index 94d6ec0e16f8..2eda4f378bcc 100644 const std::unique_ptr<service_manager::ServiceContextRef> service_ref_; +