diff options
| author | Timo Teräs <timo.teras@iki.fi> | 2018-12-14 11:46:22 +0000 |
|---|---|---|
| committer | Timo Teräs <timo.teras@iki.fi> | 2018-12-14 11:47:11 +0000 |
| commit | 3a9dae77f9b009c82b2a95ef18c0283c59640772 (patch) | |
| tree | 2e457fd8f666a493a6073a85ca2c2df5c7dca7bf /testing | |
| parent | 05aabd99257ae84e15323bef14149cd7d1d6bfbc (diff) | |
| download | aports-3a9dae77f9b009c82b2a95ef18c0283c59640772.tar.bz2 aports-3a9dae77f9b009c82b2a95ef18c0283c59640772.tar.xz | |
testing/firefox: inhibit musl isatty() sandbox violations
Diffstat (limited to 'testing')
| -rw-r--r-- | testing/firefox/APKBUILD | 4 | ||||
| -rw-r--r-- | testing/firefox/fix-seccomp-bpf.patch | 22 |
2 files changed, 19 insertions, 7 deletions
diff --git a/testing/firefox/APKBUILD b/testing/firefox/APKBUILD index 85d87f70f7..37f5f9db0a 100644 --- a/testing/firefox/APKBUILD +++ b/testing/firefox/APKBUILD @@ -4,7 +4,7 @@ pkgname=firefox pkgver=62.0.3 _pkgver=$pkgver _xulver=$pkgver -pkgrel=0 +pkgrel=1 pkgdesc="Firefox web browser" url="https://www.firefox.com/" # limited by rust and cargo @@ -218,7 +218,7 @@ sha512sums="487bb7791284367158c79cf7918fecf3d598627a6416e679aeb5d22626089aeffe07 0b3f1e4b9fdc868e4738b5c81fd6c6128ce8885b260affcb9a65ff9d164d7232626ce1291aaea70132b3e3124f5e13fef4d39326b8e7173e362a823722a85127 stab.h 2f4f15974d52de4bb273b62a332d13620945d284bbc6fe6bd0a1f58ff7388443bc1d3bf9c82cc31a8527aad92b0cd3a1bc41d0af5e1800e0dcbd7033e58ffd71 fix-fortify-system-wrappers.patch 09bc32cf9ee81b9cc6bb58ddbc66e6cc5c344badff8de3435cde5848e5a451e0172153231db85c2385ff05b5d9c20760cb18e4138dfc99060a9e960de2befbd5 fix-fortify-inline.patch -70863b985427b9653ce5e28d6064f078fb6d4ccf43dd1b68e72f97f44868fc0ce063161c39a4e77a0a1a207b7365d5dc7a7ca5e68c726825eba814f2b93e2f5d fix-seccomp-bpf.patch +2f713a270f7d1588ec4a0b9c21e5a0d20823954e6a64293ee1a391f80d38af6c0a80b3d35c3ada59b605f6032fb2af3040cd8ca7f424b0e620cc53fd12674fd9 fix-seccomp-bpf.patch a2925045154f4fd34e5fc056656f4f9da100341529e5d4104d249154db0c7863384083f421ce6e47e0f20566a8b20787fa35444c7933c03cd03f96f06dcd4532 fix-toolkit.patch b46cb90d4fdd1a925a61e2c6c545489cd542f5d82980c529361c02042eed31d5c26972b5e237c1a020f87ffcfd12736d1f4f6e33eaa83ae156d523c808c718cb fix-tools.patch bdcd1b402d2ec94957ba5d08cbad7b1a7f59c251c311be9095208491a05abb05a956c79f27908e1f26b54a3679387b2f33a51e945b650671ad85c0a2d59a5a29 mallinfo.patch diff --git a/testing/firefox/fix-seccomp-bpf.patch b/testing/firefox/fix-seccomp-bpf.patch index 47cde56c74..ee6d666400 100644 --- a/testing/firefox/fix-seccomp-bpf.patch +++ b/testing/firefox/fix-seccomp-bpf.patch @@ -1,8 +1,9 @@ ---- a/security/sandbox/chromium/sandbox/linux/seccomp-bpf/trap.cc.orig 2015-09-23 09:10:08.812740571 +0200 -+++ b/security/sandbox/chromium/sandbox/linux/seccomp-bpf/trap.cc 2015-09-23 09:11:38.404746155 +0200 -@@ -23,6 +23,11 @@ - #include "sandbox/linux/services/android_ucontext.h" - #endif +diff -ru firefox-62.0.3.orig/security/sandbox/chromium/sandbox/linux/seccomp-bpf/trap.cc firefox-62.0.3/security/sandbox/chromium/sandbox/linux/seccomp-bpf/trap.cc +--- firefox-62.0.3.orig/security/sandbox/chromium/sandbox/linux/seccomp-bpf/trap.cc 2018-12-14 08:53:46.083976137 +0000 ++++ firefox-62.0.3/security/sandbox/chromium/sandbox/linux/seccomp-bpf/trap.cc 2018-12-14 08:51:22.084596411 +0000 +@@ -25,6 +25,11 @@ + #include "sandbox/linux/system_headers/linux_seccomp.h" + #include "sandbox/linux/system_headers/linux_signal.h" +// musl libc defines siginfo_t __si_fields instead of _sifields +#if defined(OS_LINUX) && !defined(__GLIBC__) @@ -12,3 +13,14 @@ namespace { struct arch_sigsys { +diff -ru firefox-62.0.3.orig/security/sandbox/linux/SandboxFilter.cpp firefox-62.0.3/security/sandbox/linux/SandboxFilter.cpp +--- firefox-62.0.3.orig/security/sandbox/linux/SandboxFilter.cpp 2018-10-01 18:35:28.000000000 +0000 ++++ firefox-62.0.3/security/sandbox/linux/SandboxFilter.cpp 2018-12-14 08:57:50.645264590 +0000 +@@ -1005,6 +1005,7 @@ + // ffmpeg, and anything else that calls isatty(), will be told + // that nothing is a typewriter: + .ElseIf(request == TCGETS, Error(ENOTTY)) ++ .ElseIf(request == TIOCGWINSZ, Error(ENOTTY)) + // Allow anything that isn't a tty ioctl, for now; bug 1302711 + // will cover changing this to a default-deny policy. + .ElseIf(shifted_type != kTtyIoctls, Allow()) |