From 09a23a2285279d6d12ad1d33a3f141f4c254a4e2 Mon Sep 17 00:00:00 2001 From: Peter Bui Date: Wed, 3 Feb 2021 15:13:04 -0500 Subject: [PATCH 1/2] chromium: update to 88.0.4324.150. - Built for x86_64, x86_64-musl, i686. - Tested on x86_64. --- .../patches/chromium-88-glibc-2.33.patch | 144 ++++++++++++++++++ srcpkgs/chromium/template | 4 +- 2 files changed, 146 insertions(+), 2 deletions(-) create mode 100644 srcpkgs/chromium/patches/chromium-88-glibc-2.33.patch diff --git a/srcpkgs/chromium/patches/chromium-88-glibc-2.33.patch b/srcpkgs/chromium/patches/chromium-88-glibc-2.33.patch new file mode 100644 index 00000000000..64306d5e429 --- /dev/null +++ b/srcpkgs/chromium/patches/chromium-88-glibc-2.33.patch @@ -0,0 +1,144 @@ +# Patch made by Kevin Kofler +# https://bugzilla.redhat.com/show_bug.cgi?id=1904652 + +diff -up chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc.fstatfix chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc +--- sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc.fstatfix 2021-01-25 10:11:45.427436398 -0500 ++++ sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc 2021-01-25 10:12:51.337699003 -0500 +@@ -257,6 +257,18 @@ ResultExpr EvaluateSyscallImpl(int fs_de + return RestrictKillTarget(current_pid, sysno); + } + ++#if defined(__NR_newfstatat) ++ if (sysno == __NR_newfstatat) { ++ return RewriteFstatatSIGSYS(); ++ } ++#endif ++ ++#if defined(__NR_fstatat64) ++ if (sysno == __NR_fstatat64) { ++ return RewriteFstatatSIGSYS(); ++ } ++#endif ++ + if (SyscallSets::IsFileSystem(sysno) || + SyscallSets::IsCurrentDirectory(sysno)) { + return Error(fs_denied_errno); +diff -up chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc.fstatfix chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc +--- sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc.fstatfix 2021-01-25 10:13:10.179774081 -0500 ++++ sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc 2021-01-25 10:16:18.790525746 -0500 +@@ -6,6 +6,8 @@ + + #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h" + ++#include ++#include + #include + #include + #include +@@ -355,6 +357,35 @@ intptr_t SIGSYSSchedHandler(const struct + return -ENOSYS; + } + ++intptr_t SIGSYSFstatatHandler(const struct arch_seccomp_data& args, ++ void* aux) { ++ switch (args.nr) { ++#if defined(__NR_newfstatat) ++ case __NR_newfstatat: ++#endif ++#if defined(__NR_fstatat64) ++ case __NR_fstatat64: ++#endif ++#if defined(__NR_newfstatat) || defined(__NR_fstatat64) ++ if (*reinterpret_cast(args.args[1]) == '\0' ++ && args.args[3] == static_cast(AT_EMPTY_PATH)) { ++ return sandbox::sys_fstat64(static_cast(args.args[0]), ++ reinterpret_cast(args.args[2])); ++ } else { ++ errno = EACCES; ++ return -1; ++ } ++ break; ++#endif ++ } ++ ++ CrashSIGSYS_Handler(args, aux); ++ ++ // Should never be reached. ++ RAW_CHECK(false); ++ return -ENOSYS; ++} ++ + bpf_dsl::ResultExpr CrashSIGSYS() { + return bpf_dsl::Trap(CrashSIGSYS_Handler, NULL); + } +@@ -387,6 +418,10 @@ bpf_dsl::ResultExpr RewriteSchedSIGSYS() + return bpf_dsl::Trap(SIGSYSSchedHandler, NULL); + } + ++bpf_dsl::ResultExpr RewriteFstatatSIGSYS() { ++ return bpf_dsl::Trap(SIGSYSFstatatHandler, NULL); ++} ++ + void AllocateCrashKeys() { + #if !defined(OS_NACL_NONSFI) + if (seccomp_crash_key) +diff -up chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h.fstatfix chromium-88.0.4324.96/sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h +--- sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h.fstatfix 2021-01-25 10:16:36.982598236 -0500 ++++ sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h 2021-01-25 10:18:45.705111027 -0500 +@@ -62,6 +62,10 @@ SANDBOX_EXPORT intptr_t SIGSYSPtraceFail + // sched_setparam(), sched_setscheduler() + SANDBOX_EXPORT intptr_t SIGSYSSchedHandler(const arch_seccomp_data& args, + void* aux); ++// If the fstatat syscall is actually a disguised fstat, calls the regular fstat ++// syscall, otherwise, crashes in the same way as CrashSIGSYS_Handler. ++SANDBOX_EXPORT intptr_t SIGSYSFstatatHandler(const struct arch_seccomp_data& args, ++ void* aux); + + // Variants of the above functions for use with bpf_dsl. + SANDBOX_EXPORT bpf_dsl::ResultExpr CrashSIGSYS(); +@@ -72,6 +76,7 @@ SANDBOX_EXPORT bpf_dsl::ResultExpr Crash + SANDBOX_EXPORT bpf_dsl::ResultExpr CrashSIGSYSFutex(); + SANDBOX_EXPORT bpf_dsl::ResultExpr CrashSIGSYSPtrace(); + SANDBOX_EXPORT bpf_dsl::ResultExpr RewriteSchedSIGSYS(); ++SANDBOX_EXPORT bpf_dsl::ResultExpr RewriteFstatatSIGSYS(); + + // Allocates a crash key so that Seccomp information can be recorded. + void AllocateCrashKeys(); +diff -up chromium-88.0.4324.96/sandbox/linux/services/syscall_wrappers.cc.fstatfix chromium-88.0.4324.96/sandbox/linux/services/syscall_wrappers.cc +--- sandbox/linux/services/syscall_wrappers.cc.fstatfix 2021-01-25 10:18:53.307141311 -0500 ++++ sandbox/linux/services/syscall_wrappers.cc 2021-01-25 10:19:46.982355293 -0500 +@@ -261,4 +261,13 @@ int sys_sigaction(int signum, + + #endif // defined(MEMORY_SANITIZER) + ++SANDBOX_EXPORT int sys_fstat64(int fd, struct stat64 *buf) ++{ ++#if defined(__NR_fstat64) ++ return syscall(__NR_fstat64, fd, buf); ++#else ++ return syscall(__NR_fstat, fd, buf); ++#endif ++} ++ + } // namespace sandbox +diff -up chromium-88.0.4324.96/sandbox/linux/services/syscall_wrappers.h.fstatfix chromium-88.0.4324.96/sandbox/linux/services/syscall_wrappers.h +--- sandbox/linux/services/syscall_wrappers.h.fstatfix 2021-01-25 10:19:53.115379741 -0500 ++++ sandbox/linux/services/syscall_wrappers.h 2021-01-25 10:20:45.485588421 -0500 +@@ -17,6 +17,7 @@ struct sock_fprog; + struct rlimit64; + struct cap_hdr; + struct cap_data; ++struct stat64; + + namespace sandbox { + +@@ -84,6 +85,9 @@ SANDBOX_EXPORT int sys_sigaction(int sig + const struct sigaction* act, + struct sigaction* oldact); + ++// Recent glibc rewrites fstat to fstatat. ++SANDBOX_EXPORT int sys_fstat64(int fd, struct stat64 *buf); ++ + } // namespace sandbox + + #endif // SANDBOX_LINUX_SERVICES_SYSCALL_WRAPPERS_H_ diff --git a/srcpkgs/chromium/template b/srcpkgs/chromium/template index 348389798a2..b543051ccf7 100644 --- a/srcpkgs/chromium/template +++ b/srcpkgs/chromium/template @@ -1,7 +1,7 @@ # Template file for 'chromium' pkgname=chromium # See http://www.chromium.org/developers/calendar for the latest version -version=88.0.4324.96 +version=88.0.4324.150 revision=1 archs="i686* x86_64* aarch64* armv7l* ppc64le*" short_desc="Google's attempt at creating a safer, faster, and more stable browser" @@ -9,7 +9,7 @@ maintainer="Enno Boland " license="BSD-3-Clause" homepage="https://www.chromium.org/" distfiles="https://commondatastorage.googleapis.com/chromium-browser-official/${pkgname}-${version}.tar.xz" -checksum=8995c5bb28559579f3bed51841420253637f912c425908fe5aa389ce40e9c79f +checksum=ae12e94392986c6b8ea4413356a49bae0a19356ffe2ea95495303cf2decb38c3 nocross=yes lib32disabled=yes From 5a154e1adec596115b2f6c9342b4c78970edd239 Mon Sep 17 00:00:00 2001 From: Peter Bui Date: Thu, 4 Feb 2021 15:39:38 -0500 Subject: [PATCH 2/2] chromium-widevine: update to 88.0.4324.150. --- srcpkgs/chromium-widevine/INSTALL | 2 +- srcpkgs/chromium-widevine/template | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/srcpkgs/chromium-widevine/INSTALL b/srcpkgs/chromium-widevine/INSTALL index de1264d34d6..703be9f5101 100644 --- a/srcpkgs/chromium-widevine/INSTALL +++ b/srcpkgs/chromium-widevine/INSTALL @@ -1,6 +1,6 @@ # INSTALL -checksum=4c3fca6ba917db4635368c99df61cd811c5138daa1ad890d4dc4271dd0014124 +checksum=404f13af1288a824898674e83c42bcdffba098178ff96d266525cd7e2fdcd077 _baseUrl="https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable" _filename="google-chrome-stable_${VERSION%_*}-1_amd64.deb" DISTFILE="${_baseUrl}/${_filename}" diff --git a/srcpkgs/chromium-widevine/template b/srcpkgs/chromium-widevine/template index 8dc78d1edec..b54e4b56f39 100644 --- a/srcpkgs/chromium-widevine/template +++ b/srcpkgs/chromium-widevine/template @@ -6,7 +6,7 @@ _chromeVersion="current" _channel="stable" pkgname=chromium-widevine -version=88.0.4324.96 +version=88.0.4324.150 revision=1 archs="x86_64" create_wrksrc=yes