proot: update to 5.2.0.

- Delete obsolete patches and fix the rest.
- Add pkg-config (otherwise, undefined talloc_* refs abound).
- Use docs/GNUMakefile to generate manpage.
- Force Makefile to recognize package version.

Closes: #33272 [via git-merge-pr]
This commit is contained in:
Antonio Gurgel 2021-11-02 17:27:01 -07:00 committed by Piraty
parent b4975f6096
commit d977b3b5b7
No known key found for this signature in database
GPG key ID: 82F2CC796BD07077
10 changed files with 24 additions and 518 deletions

View file

@ -1,48 +0,0 @@
# upstream: yes
# https://github.com/proot-me/proot/pull/203
# adapted to fit proot's old release
From 2e796c5a0ed3c04d0816405422c8d6a25eccf5c2 Mon Sep 17 00:00:00 2001
From: Michal Bednarski <bednarski.michal2@gmail.com>
Date: Thu, 5 Sep 2019 15:19:08 +0200
Subject: [PATCH] Prevent tracees from becoming undumpable
--- a/src/syscall/enter.c
+++ b/src/syscall/enter.c
@@ -26,7 +26,8 @@
#include <linux/net.h> /* SYS_*, */
#include <fcntl.h> /* AT_FDCWD, */
#include <limits.h> /* PATH_MAX, */
-
+#include <string.h> /* strcpy */
+#include <sys/prctl.h> /* PR_SET_DUMPABLE */
#include "syscall/syscall.h"
#include "syscall/sysnum.h"
#include "syscall/socket.h"
@@ -563,6 +564,15 @@
status = translate_path2(tracee, newdirfd, newpath, SYSARG_3, SYMLINK);
break;
+
+ case PR_prctl:
+ /* Prevent tracees from setting dumpable flag.
+ * (Otherwise it could break tracee memory access) */
+ if (peek_reg(tracee, CURRENT, SYSARG_1) == PR_SET_DUMPABLE) {
+ set_sysnum(tracee, PR_void);
+ status = 0;
+ }
+ break;
}
end:
--- a/src/syscall/seccomp.c
+++ b/src/syscall/seccomp.c
@@ -377,6 +377,7 @@
{ PR_open, 0 },
{ PR_openat, 0 },
{ PR_pivot_root, 0 },
+ { PR_prctl, 0 },
{ PR_ptrace, FILTER_SYSEXIT },
{ PR_readlink, FILTER_SYSEXIT },
{ PR_readlinkat, FILTER_SYSEXIT },

View file

@ -1,134 +0,0 @@
diff -ru proot-5.1.0.orig/src/arch.h proot-5.1.0/src/arch.h
--- a/src/arch.h
+++ b/src/arch.h
@@ -125,6 +125,9 @@
#define OFFSETOF_STAT_UID_32 0
#define OFFSETOF_STAT_GID_32 0
+ #define EXEC_PIC_ADDRESS 0x500000000000
+ #define INTERP_PIC_ADDRESS 0x6f0000000000
+
#elif defined(ARCH_X86)
#define SYSNUMS_HEADER1 "syscall/sysnums-i386.h"
diff -ru proot-5.1.0.orig/src/loader/assembly-arm64.h proot-5.1.0/src/loader/assembly-arm64.h
--- /dev/null
+++ b/src/loader/assembly-arm64.h
@@ -0,0 +1,93 @@
+/* -*- c-set-style: "K&R"; c-basic-offset: 8 -*-
+ *
+ * This file is part of PRoot.
+ *
+ * Copyright (C) 2014 STMicroelectronics
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301 USA.
+ */
+
+#define BRANCH(stack_pointer, destination) do { \
+ asm volatile ( \
+ "// Restore initial stack pointer. \n\t" \
+ "mov sp, %0 \n\t" \
+ " \n\t" \
+ "// Clear rtld_fini. \n\t" \
+ "mov x0, #0 \n\t" \
+ " \n\t" \
+ "// Start the program. \n\t" \
+ "br %1 \n" \
+ : /* no output */ \
+ : "r" (stack_pointer), "r" (destination) \
+ : "memory", "sp", "x0"); \
+ __builtin_unreachable(); \
+ } while (0)
+
+#define PREPARE_ARGS_1(arg1_) \
+ register word_t arg1 asm("x0") = arg1_; \
+
+#define PREPARE_ARGS_3(arg1_, arg2_, arg3_) \
+ PREPARE_ARGS_1(arg1_) \
+ register word_t arg2 asm("x1") = arg2_; \
+ register word_t arg3 asm("x2") = arg3_; \
+
+#define PREPARE_ARGS_4(arg1_, arg2_, arg3_, arg4_) \
+ PREPARE_ARGS_3(arg1_, arg2_, arg3_) \
+ register word_t arg4 asm("x3") = arg4_;
+
+#define PREPARE_ARGS_6(arg1_, arg2_, arg3_, arg4_, arg5_, arg6_) \
+ PREPARE_ARGS_3(arg1_, arg2_, arg3_) \
+ register word_t arg4 asm("x3") = arg4_; \
+ register word_t arg5 asm("x4") = arg5_; \
+ register word_t arg6 asm("x5") = arg6_;
+
+#define OUTPUT_CONTRAINTS_1 \
+ "r" (arg1)
+
+#define OUTPUT_CONTRAINTS_3 \
+ OUTPUT_CONTRAINTS_1, \
+ "r" (arg2), "r" (arg3)
+
+#define OUTPUT_CONTRAINTS_4 \
+ OUTPUT_CONTRAINTS_3, \
+ "r" (arg4)
+
+#define OUTPUT_CONTRAINTS_6 \
+ OUTPUT_CONTRAINTS_3, \
+ "r" (arg4), "r" (arg5), "r" (arg6)
+
+#define SYSCALL(number_, nb_args, args...) \
+ ({ \
+ register word_t number asm("w8") = number_; \
+ register word_t result asm("x0"); \
+ PREPARE_ARGS_##nb_args(args) \
+ asm volatile ( \
+ "svc #0x00000000 \n\t" \
+ : "=r" (result) \
+ : "r" (number), \
+ OUTPUT_CONTRAINTS_##nb_args \
+ : "memory"); \
+ result; \
+ })
+
+#define OPENAT 56
+#define CLOSE 57
+#define MMAP 222
+#define MMAP_OFFSET_SHIFT 0
+#define EXECVE 221
+#define EXIT 93
+#define PRCTL 167
+
diff -ru proot-5.1.0.orig/src/loader/loader.c proot-5.1.0/src/loader/loader.c
--- a/src/loader/loader.c
+++ b/src/loader/loader.c
@@ -39,6 +39,8 @@
# include "loader/assembly-x86_64.h"
#elif defined(ARCH_ARM_EABI)
# include "loader/assembly-arm.h"
+#elif defined(ARCH_ARM64)
+# include "loader/assembly-arm64.h"
#elif defined(ARCH_X86)
# include "loader/assembly-x86.h"
#else
@@ -134,7 +136,11 @@
/* Fall through. */
case LOAD_ACTION_OPEN:
+#ifdef OPENAT
+ fd = SYSCALL(OPENAT, 4, AT_FDCWD, stmt->open.string_address, O_RDONLY, 0);
+#else
fd = SYSCALL(OPEN, 3, stmt->open.string_address, O_RDONLY, 0);
+#endif
if (unlikely((int) fd < 0))
FATAL();

View file

@ -1,28 +1,17 @@
# reason: https://github.com/proot-me/proot/issues/106
# src: Debian10
# Based on a patch by Simon McVittie <smcv@debian.org>:
# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=847292#16
From: Simon McVittie <smcv@debian.org>
Date: Sat, 14 Jan 2017 15:52:13 +0000
X-Dgit-Generated: 5.1.0-1.2 dcc5f0999759be03aed5b62a8683e0b965d0219d
Subject: Disable seccomp-based tracing performance improvement
It is faster (according to upstream documentation), but on current
(4.8.4+) kernels it just segfaults. Software that works slowly seems
better than software that doesn't work at all.
Bug: https://github.com/proot-me/PRoot/issues/106
---
# Stops proot from segfaulting by disabling seccomp.
# https://github.com/proot-me/proot/issues/106
--- a/src/GNUmakefile
+++ b/src/GNUmakefile
@@ -105,7 +105,7 @@ CHECK_VERSION = VERSION=$$($(GIT) descri
then /bin/echo -e "\#undef VERSION\n\#define VERSION \"$${VERSION}\""; \
fi;
@@ -132,7 +132,7 @@ ifneq ($(and $(HAS_SWIG),$(HAS_PYTHON_CONFIG)),)
CHECK_PYTHON_EXTENSION = /bin/echo -e "\#define HAVE_PYTHON_EXTENSION"
endif
-CHECK_FEATURES = process_vm seccomp_filter
+CHECK_FEATURES = process_vm
CHECK_PROGRAMS = $(foreach feature,$(CHECK_FEATURES),.check_$(feature))
CHECK_OBJECTS = $(foreach feature,$(CHECK_FEATURES),.check_$(feature).o)
CHECK_RESULTS = $(foreach feature,$(CHECK_FEATURES),.check_$(feature).res)

View file

@ -1,193 +0,0 @@
From 25e8461cbe56a3f035df145d9d762b65aa3eedb7 Mon Sep 17 00:00:00 2001
From: Jorge Gomes <jorge@lip.pt>
Date: Mon, 13 Feb 2017 20:37:17 +0000
Subject: [PATCH] fix event.c for seccomp and ptrace
---
src/tracee/event.c | 129 ++++++++++++++++++++++++++++++++++++-----------------
1 file changed, 88 insertions(+), 41 deletions(-)
diff --git src/tracee/event.c src/tracee/event.c
index bafc3c5..64166f6 100644
--- a/src/tracee/event.c
+++ b/src/tracee/event.c
@@ -20,6 +20,7 @@
* 02110-1301 USA.
*/
+#include <stdio.h>
#include <sched.h> /* CLONE_*, */
#include <sys/types.h> /* pid_t, */
#include <sys/ptrace.h> /* ptrace(1), PTRACE_*, */
@@ -47,6 +48,7 @@
#include "attribute.h"
#include "compat.h"
+
/**
* Start @tracee->exe with the given @argv[]. This function
* returns -errno if an error occurred, otherwise 0.
@@ -205,6 +207,27 @@ static void print_talloc_hierarchy(int signum, siginfo_t *siginfo UNUSED, void *
static int last_exit_status = -1;
/**
+ * Check if kernel >= 4.8
+ */
+bool is_kernel_4_8(void) {
+ struct utsname utsname;
+ int status;
+ static bool version_48 = false;
+ static int major = 0;
+ static int minor = 0;
+ if (! major) {
+ status = uname(&utsname);
+ if (status < 0)
+ return false;
+ sscanf(utsname.release, "%d.%d", &major, &minor);
+ if (major >= 4)
+ if (minor >= 8)
+ version_48 = true;
+ }
+ return version_48;
+}
+
+/**
* Check if this instance of PRoot can *technically* handle @tracee.
*/
static void check_architecture(Tracee *tracee)
@@ -362,6 +385,7 @@ int event_loop()
int handle_tracee_event(Tracee *tracee, int tracee_status)
{
static bool seccomp_detected = false;
+ static bool seccomp_enabled = false;
pid_t pid = tracee->pid;
long status;
int signal;
@@ -432,6 +456,7 @@ int handle_tracee_event(Tracee *tracee, int tracee_status)
status = ptrace(PTRACE_SETOPTIONS, tracee->pid, NULL,
default_ptrace_options | PTRACE_O_TRACESECCOMP);
if (status < 0) {
+ seccomp_enabled = false;
/* ... otherwise use default options only. */
status = ptrace(PTRACE_SETOPTIONS, tracee->pid, NULL,
default_ptrace_options);
@@ -440,8 +465,71 @@ int handle_tracee_event(Tracee *tracee, int tracee_status)
exit(EXIT_FAILURE);
}
}
+ else {
+ if (getenv("PROOT_NO_SECCOMP") == NULL)
+ seccomp_enabled = true;
+ }
}
/* Fall through. */
+ case SIGTRAP | PTRACE_EVENT_SECCOMP2 << 8:
+ case SIGTRAP | PTRACE_EVENT_SECCOMP << 8:
+
+ if (is_kernel_4_8()) {
+ if (seccomp_enabled) {
+ if (!seccomp_detected) {
+ VERBOSE(tracee, 1, "ptrace acceleration (seccomp mode 2) enabled");
+ tracee->seccomp = ENABLED;
+ seccomp_detected = true;
+ }
+
+ unsigned long flags = 0;
+ status = ptrace(PTRACE_GETEVENTMSG, tracee->pid, NULL, &flags);
+ if (status < 0)
+ break;
+ }
+ }
+ else if (signal == (SIGTRAP | PTRACE_EVENT_SECCOMP2 << 8) ||
+ signal == (SIGTRAP | PTRACE_EVENT_SECCOMP << 8)) {
+ unsigned long flags = 0;
+
+ signal = 0;
+
+ if (!seccomp_detected) {
+ VERBOSE(tracee, 1, "ptrace acceleration (seccomp mode 2) enabled");
+ tracee->seccomp = ENABLED;
+ seccomp_detected = true;
+ }
+
+ /* Use the common ptrace flow if seccomp was
+ * explicitely disabled for this tracee. */
+ if (tracee->seccomp != ENABLED)
+ break;
+
+ status = ptrace(PTRACE_GETEVENTMSG, tracee->pid, NULL, &flags);
+ if (status < 0)
+ break;
+
+ /* Use the common ptrace flow when
+ * sysexit has to be handled. */
+ if ((flags & FILTER_SYSEXIT) != 0) {
+ tracee->restart_how = PTRACE_SYSCALL;
+ break;
+ }
+
+ /* Otherwise, handle the sysenter
+ * stage right now. */
+ tracee->restart_how = PTRACE_CONT;
+ translate_syscall(tracee);
+
+ /* This syscall has disabled seccomp, so move
+ * the ptrace flow back to the common path to
+ * ensure its sysexit will be handled. */
+ if (tracee->seccomp == DISABLING)
+ tracee->restart_how = PTRACE_SYSCALL;
+ break;
+ }
+
+ /* Fall through. */
case SIGTRAP | 0x80:
signal = 0;
@@ -490,47 +578,6 @@ int handle_tracee_event(Tracee *tracee, int tracee_status)
}
break;
- case SIGTRAP | PTRACE_EVENT_SECCOMP2 << 8:
- case SIGTRAP | PTRACE_EVENT_SECCOMP << 8: {
- unsigned long flags = 0;
-
- signal = 0;
-
- if (!seccomp_detected) {
- VERBOSE(tracee, 1, "ptrace acceleration (seccomp mode 2) enabled");
- tracee->seccomp = ENABLED;
- seccomp_detected = true;
- }
-
- /* Use the common ptrace flow if seccomp was
- * explicitely disabled for this tracee. */
- if (tracee->seccomp != ENABLED)
- break;
-
- status = ptrace(PTRACE_GETEVENTMSG, tracee->pid, NULL, &flags);
- if (status < 0)
- break;
-
- /* Use the common ptrace flow when
- * sysexit has to be handled. */
- if ((flags & FILTER_SYSEXIT) != 0) {
- tracee->restart_how = PTRACE_SYSCALL;
- break;
- }
-
- /* Otherwise, handle the sysenter
- * stage right now. */
- tracee->restart_how = PTRACE_CONT;
- translate_syscall(tracee);
-
- /* This syscall has disabled seccomp, so move
- * the ptrace flow back to the common path to
- * ensure its sysexit will be handled. */
- if (tracee->seccomp == DISABLING)
- tracee->restart_how = PTRACE_SYSCALL;
- break;
- }
-
case SIGTRAP | PTRACE_EVENT_VFORK << 8:
signal = 0;
(void) new_child(tracee, CLONE_VFORK);

View file

@ -1,34 +0,0 @@
--- a/src/ptrace/ptrace.c 2014-12-15 15:18:11.000000000 +0100
+++ b/src/ptrace/ptrace.c 2015-07-12 13:13:45.970093333 +0200
@@ -28,6 +28,7 @@
#include <sys/uio.h> /* struct iovec, */
#include <sys/param.h> /* MIN(), MAX(), */
#include <string.h> /* memcpy(3), */
+#include <linux/wait.h> /* __WALL, __WCLONE */
#include "ptrace/ptrace.h"
#include "ptrace/user.h"
--- a/src/ptrace/wait.c 2014-12-15 15:18:11.000000000 +0100
+++ b/src/ptrace/wait.c 2015-07-12 13:16:41.930106019 +0200
@@ -26,6 +26,7 @@
#include <stdbool.h> /* bool, true, false, */
#include <signal.h> /* SIG*, */
#include <talloc.h> /* talloc*, */
+#include <linux/wait.h> /* __WALL, __WCLONE */
#include "ptrace/wait.h"
#include "ptrace/ptrace.h"
--- a/src/tracee/tracee.c 2014-12-15 15:18:11.000000000 +0100
+++ b/src/tracee/tracee.c 2015-07-12 13:20:01.058120375 +0200
@@ -31,6 +31,11 @@
#include <signal.h> /* kill(2), SIGKILL, */
#include <sys/ptrace.h> /* ptrace(2), PTRACE_*, */
#include <errno.h> /* E*, */
+#include <linux/wait.h> /* __WALL, __WCLONE */
+
+#if !defined(__W_STOPCODE)
+#define __W_STOPCODE(sig) ((sig) << 8 | 0x7f)
+#endif
#include "tracee/tracee.h"
#include "tracee/reg.h"

View file

@ -1,40 +0,0 @@
From d649854ddb66779950954aac99d960379c631a71 Mon Sep 17 00:00:00 2001
From: Nicolas Cornu <ncornu@aldebaran.com>
Date: Wed, 29 Jul 2015 14:52:57 +0200
Subject: [PATCH] Fix use of size
---
src/execve/enter.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git src/execve/enter.c b/src/execve/enter.c
index 8f22d9c..4c163a1 100644
--- a/src/execve/enter.c
+++ b/src/execve/enter.c
@@ -454,10 +454,10 @@ static int expand_runner(Tracee* tracee, char host_path[PATH_MAX], char user_pat
}
extern unsigned char _binary_loader_exe_start;
-extern unsigned char _binary_loader_exe_size;
+extern unsigned char _binary_loader_exe_end;
extern unsigned char WEAK _binary_loader_m32_exe_start;
-extern unsigned char WEAK _binary_loader_m32_exe_size;
+extern unsigned char WEAK _binary_loader_m32_exe_end;
/**
* Extract the built-in loader. This function returns NULL if an
@@ -483,11 +483,11 @@ static char *extract_loader(const Tracee *tracee, bool wants_32bit_version)
if (wants_32bit_version) {
start = (void *) &_binary_loader_m32_exe_start;
- size = (size_t) &_binary_loader_m32_exe_size;
+ size = (size_t)(&_binary_loader_m32_exe_end-&_binary_loader_m32_exe_start);
}
else {
start = (void *) &_binary_loader_exe_start;
- size = (size_t) &_binary_loader_exe_size;
+ size = (size_t) (&_binary_loader_exe_end-&_binary_loader_exe_start);
}
status2 = write(fd, start, size);

View file

@ -1,6 +1,8 @@
diff --git a/src/GNUmakefile b/src/GNUmakefile
index 777b058..3f25193 100644
--- a/src/GNUmakefile
+++ b/src/GNUmakefile
@@ -8,11 +8,11 @@
@@ -8,11 +8,11 @@ SRC = $(dir $(firstword $(MAKEFILE_LIST)))
GIT = git
RM = rm
INSTALL = install
@ -13,10 +15,10 @@
+STRIP = :
+OBJCOPY ?= $(CROSS_COMPILE)objcopy
+OBJDUMP ?= $(CROSS_COMPILE)objdump
PYTHON = python3
CPPFLAGS += -D_FILE_OFFSET_BITS=64 -D_GNU_SOURCE -I. -I$(VPATH)
CFLAGS += -Wall -Wextra -O2
@@ -86,7 +86,7 @@
HAS_SWIG := $(shell swig -version 2>/dev/null)
@@ -104,7 +104,7 @@ quiet_CC = @echo " CC $@"; $(CC)
quiet_LD = @echo " LD $@"; $(LD)
quiet_INSTALL = @echo " INSTALL $?"; $(INSTALL)
@ -25,14 +27,3 @@
ifeq ($(V), 0)
quiet = quiet_
Q = @
@@ -140,8 +140,8 @@
OBJIFY = $($(quiet)GEN) \
$(OBJCOPY) \
- --input binary \
- --output `env LANG=C $(OBJDUMP) -f cli/cli.o | \
+ --input-target binary \
+ --output-target `env LANG=C $(OBJDUMP) -f cli/cli.o | \
grep 'file format' | awk '{print $$4}'` \
--binary-architecture `env LANG=C $(OBJDUMP) -f cli/cli.o | \
grep architecture | cut -f 1 -d , | awk '{print $$2}'` \

View file

@ -1,28 +0,0 @@
--- a/src/cli/cli.c 2014-12-15 15:18:11.000000000 +0100
+++ b/src/cli/cli.c 2015-07-12 13:18:46.548115003 +0200
@@ -30,7 +30,9 @@
#include <sys/types.h> /* getpid(2), */
#include <unistd.h> /* getpid(2), */
#include <errno.h> /* errno(3), */
+#if defined(__GLIBC__)
#include <execinfo.h> /* backtrace_symbols(3), */
+#endif
#include <limits.h> /* INT_MAX, */
#include "cli/cli.h"
@@ -555,6 +557,7 @@
void __cyg_profile_func_enter(void *this_function, void *call_site) DONT_INSTRUMENT;
void __cyg_profile_func_enter(void *this_function, void *call_site)
{
+#if defined(__GLIBC__)
void *const pointers[] = { this_function, call_site };
char **symbols = NULL;
@@ -567,6 +570,7 @@
end:
if (symbols != NULL)
free(symbols);
+#endif /* defined(__GLIBC__) */
if (indent_level < INT_MAX)
indent_level++;

View file

@ -1,5 +1,5 @@
--- a/src/tracee/tracee.h 2014-12-15 15:18:11.000000000 +0100
+++ b/src/tracee/tracee.h 2015-07-12 13:12:10.726086466 +0200
--- a/src/tracee/tracee.h 2014-12-15 15:18:11.000000000 +0100
+++ b/src/tracee/tracee.h 2021-09-30 00:24:54.834523917 -0700
@@ -28,6 +28,9 @@
#include <stdbool.h> /* bool, */
#include <sys/queue.h> /* LIST_*, */
@ -8,5 +8,5 @@
+#include "ptrace_compat.h"
+#endif
#include <talloc.h> /* talloc_*, */
#include "arch.h" /* word_t, user_regs_struct, */
#include <stdint.h> /* *int*_t, */
#include <sys/wait.h> /* __WAIT_* */

View file

@ -1,18 +1,20 @@
# Template file for 'proot'
pkgname=proot
version=5.1.0
revision=7
version=5.2.0
revision=1
archs="x86_64* i686* aarch64* arm*"
build_wrksrc=src
build_style=gnu-makefile
make_use_env=yes
make_build_args="VERSION=${version}"
hostmakedepends="pkg-config python3-docutils python3-lxml"
makedepends="libarchive-devel talloc-devel"
short_desc="User-space implementation of chroot, mount --bind, and binfmt_misc"
maintainer="Piraty <piraty1@inbox.ru>"
license="GPL-2.0-or-later"
homepage="https://proot-me.github.io"
distfiles="https://github.com/proot-me/PRoot/archive/v${version}.tar.gz"
checksum=ce0a3baca8312613bd10f65bb436a3aaa28e1034f498a22c35ad0693600e01dd
checksum=1f25f9ef147bc96c9d7cd23218b7a7229f149757d91c832482b1a865b52aa62e
if [ "$XBPS_TARGET_LIBC" = "musl" ]; then
makedepends+=" musl-legacy-compat"
@ -25,5 +27,6 @@ pre_build() {
do_install() {
vbin proot
make -C ../doc
vman ../doc/proot/man.1 proot.1
}