From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-oo1-xc2b.google.com (mail-oo1-xc2b.google.com [IPv6:2607:f8b0:4864:20::c2b]) by sourceware.org (Postfix) with ESMTPS id E31C73848410 for ; Fri, 4 Jun 2021 12:21:18 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org E31C73848410 Received: by mail-oo1-xc2b.google.com with SMTP id v13-20020a4aa40d0000b02902052145a469so2169445ool.3 for ; Fri, 04 Jun 2021 05:21:18 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=kL02JXssGEQ/29NTeGBMYP3k+/RRUQWIqqSvyWDB2yI=; b=AzrA3TRUwXWdm3kUZGiDpgjIcV0K6EPDXNbp2HYR5EISwbTw9yi93GfKhZixCSsyrc ZAeVZ68yR96EG7MqAxElj8sj49ajOk9cQlbJYMbYf1JAunkezWUkdkzxWHEs3GhUjshN hBGgPJ0Syc6CR0Lx6tkkV84qmpbeEgU1w9N0e/GoHFdIS9XdY/dlJE/yutGdf2xeNzep xg/zN+GDxw9Yvj3HWYP2WU0zYS4gZ15FpBZ7oAo/XR1gGhh1Z2dWbJdVA3KHjPxvWlLL wrjPD5FM5XvHYx3gRMMb7tzY4NpXLXaJKhpFUVLIJU4t82NQy2tmq3NfhbARKYTgkj/G SOPA== X-Gm-Message-State: AOAM532dqAKkWUN76YoOaREMsKQhmCF53pnUnl8hMgqINiuw3Fo5lMHw QIR0aAjrcIUW2T2ctl4yKh8KzF/WZMOiQ1KCrQpsJ97H/Xo= X-Google-Smtp-Source: ABdhPJyWwakfkdSeP1pXbJ6if/Q0neFEgBUf57OBzhre5XKaoILqEimA+JM5PKgU1lPj6tyb4x7It2lrdeJI6F/dOIk= X-Received: by 2002:a4a:9451:: with SMTP id j17mr3276717ooi.93.1622809277262; Fri, 04 Jun 2021 05:21:17 -0700 (PDT) MIME-Version: 1.0 References: <20210601145516.3553627-1-hjl.tools@gmail.com> <20210601145516.3553627-2-hjl.tools@gmail.com> In-Reply-To: <20210601145516.3553627-2-hjl.tools@gmail.com> From: "H.J. Lu" Date: Fri, 4 Jun 2021 05:20:41 -0700 Message-ID: Subject: Re: [PATCH v8 1/3] Add an internal wrapper for clone, clone2 and clone3 To: GNU C Library Cc: Florian Weimer , Noah Goldstein , Adhemerval Zanella Content-Type: text/plain; charset="UTF-8" X-Spam-Status: No, score=-3027.6 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, KAM_NUMSUBJECT, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=no autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Jun 2021 12:21:29 -0000 On Tue, Jun 1, 2021 at 7:55 AM H.J. Lu wrote: > > The clone3 system call provides a superset of the functionality of clone > and clone2. It also provides a number of API improvements, including > the ability to specify the size of the child's stack area which can be > used by kernel to compute the shadow stack size when allocating the > shadow stack. Add: > > extern int __clone_internal (struct clone_args *__cl_args, > int (*__func) (void *__arg), void *__arg); > > to provide an abstract interface for clone, clone2 and clone3. > > 1. Simplify stack management for thread creation by passing both stack > base and size to create_thread. > 2. Consolidate clone vs clone2 differences into a single file. > 3. Call __clone3 if HAVE_CLONE3_WAPPER is defined. If __clone3 returns > -1 with ENOSYS, fall back to clone or clone2. > 4. Use only __clone_internal to clone a thread. Since the stack size > argument for create_thread is now unconditional, always pass stack size > to create_thread. > 5. Enable the public clone3 wrapper in the future after it has been > added to all targets. > > NB: Sandbox should return ENOSYS on clone3 if it is rejected: > > https://bugs.chromium.org/p/chromium/issues/detail?id=1213452#c5 The sandbox issue has been fixed by The following revision refers to this bug: https://chromium.googlesource.com/chromium/src/+/218438259dd795456f0a48f67cbe5b4e520db88b commit 218438259dd795456f0a48f67cbe5b4e520db88b Author: Matthew Denton Date: Thu Jun 03 20:06:13 2021 Linux sandbox: return ENOSYS for clone3 Because clone3 uses a pointer argument rather than a flags argument, we cannot examine the contents with seccomp, which is essential to preventing sandboxed processes from starting other processes. So, we won't be able to support clone3 in Chromium. This CL modifies the BPF policy to return ENOSYS for clone3 so glibc always uses the fallback to clone. Bug: 1213452 Change-Id: I7c7c585a319e0264eac5b1ebee1a45be2d782303 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2936184 Reviewed-by: Robert Sesek Commit-Queue: Matthew Denton Cr-Commit-Position: refs/heads/master@{#888980} [modify] https://crrev.com/218438259dd795456f0a48f67cbe5b4e520db88b/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc -- H.J.