"Operation not permitted": on ARM it only runs with "disable-sandbox" #14

m040601 · 2021-01-24T11:34:56Z

Hi, first of all thanks for your work in this extremely usefull written in C for speed and promising tool.

I've been testing and using it on my x64 Arch Linux for some months. Very happy.

It's intended to be used with terminal RSS readers, to make the articles more readable on web browsers such as lynx.

I use it with w3m. Feel free to update the README as well.

W3m is a very underrated (and badly documented) cli browser. But with incredible customizing options. It works amazingly fast with rdrview.

You can use it for a one shot operation like this:

$ rdrview -H https://www.bbc.com/news/world-asia-china-55784231 | w3m -T text/html

or

$ rdrview -H https://www.bbc.com/news/world-asia-china-55784231 | w3m -T text/html -dump

Or for interactive browsing.
You can for example add these lines to the config file, ~/.w3m/keymap

keymap \\\r COMMAND "SHELL 'rdrview -H $W3M_URL > /tmp/rdrview.html' ; LOAD /tmp/rdrview.html"

or

keymap \\\r COMMAND "SHELL 'clear; echo \"parsing page with rdrview\" ; echo ; rdrview -H $W3M_URL > /tmp/rdrview.html' ; LOAD /tmp/rdrview.html"

and then use "\r" when your browsing a page inside w3m.

My issue is when I try to run in on Arm, also Arch Linux, armv7.

I tried it on both a chromebook running:

Linux alarmsung 5.10.10-1-ARCH #1 SMP PREEMPT Sat Jan 23 23:26:35 UTC 2021 armv7l GNU/Linux

and a Raspberry Pi 2 running:

Linux alarmpi 5.4.83-4-ARCH #1 SMP PREEMPT Wed Jan 20 14:06:49 UTC 2021 armv7l GNU/Linux

I install rdrview by hand. I do not use the Arch User AUR package like this other user, #13. This AUR arch linux is not well maintained and is marked only for x64 not Arm, https://aur.archlinux.org/packages/rdrview-git

What I do instead is this.
I do git clone .. and then run make.

On both these ARM systems I have the exact same needed dependencies installed

They are the same as in my working x64 system, and they are official distro packages:

 
local/libseccomp 2.5.1-2
    Enhanced seccomp library
local/libxml2 2.9.10-8
    XML parsing library, version 2
local/libcurl-gnutls 7.74.0-1
    An URL retrieval library (linked against gnutls)

Compilation with make runs without a problem. But running it, whatever the options choosen always gets me a message:

rdrview: Operation not permitted

If I use the flag "--disable-sandbox" then it works.

I'm not a developer, and have zero understanding of C programing, syscalls or security. The only thing I could find that brought me here was the similar issue by the other user.

#10 (comment)
...I am on a musl based system....
... have to use 'disable-sandbox' to get a webpage rendered....

Additional info that might be usefull:

Some libs

Architecture : armv7h

glibc, Version         : 2.32-2
gcc, Version         : 10.2.0-1

strace

$ strace rdrview -M https://www.bbc.com/news/world-asia-china-55784231 2>> error_log.txt

error_log.txt

The compiled binary on arm:

$ file ./rdrview

./rdrview: ELF 32-bit LSB pie executable, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-armhf.so.3, BuildID[sha1]=b7438379398f311b185c1ba3a7ba9019f245321d, for GNU/Linux 3.2.0, not stripped

The text was updated successfully, but these errors were encountered:

eafer · 2021-01-25T20:39:00Z

Hi,

Hi, first of all thanks for your work in this **extremely** **usefull** written in C for speed and promising tool.

I'm glad that you like it.

My issue is when I try to run in on Arm, also Arch Linux, armv7.

Thanks for the report. These problems are expected with seccomp from time to time, so it's good that I hear about it. Try running this: strace -f rdrview -H 'https://github.com/eafer/rdrview' 2>&1 >/dev/null | grep EPERM And send me the output. That should tell us which syscalls are getting blocked, so that I can add them to the whitelist.

m040601 · 2021-01-26T10:10:41Z

...And send me the output

pulled the latest commits, compiled a fresh one, and here it is:

[pid 18413] fstat64(5, 0xbebd5b60)      = -1 EPERM (Operation not permitted)
[pid 18413] fcntl64(4, F_GETFL)         = -1 EPERM (Operation not permitted)

On 32-bit architectures, glibc can't implement its fstat() function with the fstat() syscall; it requires fstat64() instead. Add that syscall to the seccomp whitelist, which should hopefully solve this issue: #14

eafer · 2021-01-26T19:46:25Z

[pid 18413] fstat64(5, 0xbebd5b60) = -1 EPERM (Operation not permitted) [pid 18413] fcntl64(4, F_GETFL) = -1 EPERM (Operation not permitted)

Ok, I just pushed a patch that allows fstat64(). If this doesn't solve the problem, run the strace command I gave you before and send me the ouput again.

m040601 · 2021-01-27T05:56:09Z

Still failing.

$ git show origin/master --no-patch

commit ecda324fd9aa1cba07b9a00ac10af0ab7e55c663
Author: Ernesto A. Fernández <ernesto.mnd.fernandez@gmail.com>
Date:   Tue Jan 26 15:23:38 2021 -0300

    Allow 64-bit version of fstat() syscall on Linux
    ...

$ strace -f rdrview -H 'https://github.com/eafer/rdrview' 2>&1 >/dev/null | grep EPERM

[pid  4158] mmap2(NULL, 153932, PROT_READ|PROT_WRITE, MAP_SHARED, 5, 0) = -1 EPERM (Operation not permitted)
[pid  4158] fcntl64(4, F_GETFL)         = -1 EPERM (Operation not permitted)

The previous patch was not enough to get rdrview to run on 32-bit ARM: #14 (comment) Add mmap2() to the whitelist as well. This time I have tested rdrview myself on a Raspberry Pi, and it seems to work fine.

eafer · 2021-01-27T22:30:20Z

[pid 4158] mmap2(NULL, 153932, PROT_READ|PROT_WRITE, MAP_SHARED, 5, 0) = -1 EPERM (Operation not permitted)

OK, I just pushed a patch to allow mmap2(). I tested it myself this time on a Raspberry Pi, so it should work, but let me know.

m040601 · 2021-01-28T05:44:31Z

... so it should work

Yes it does. Tested on both Raspberry Pi and Chromebook (armv7).
I dont have a Raspberry Pi 4 for testing armv8/aarch64.

parkerlreed · 2021-01-29T17:46:08Z

I can confirm working on AArch64 on another rplatform

parkerlreed · 2021-01-29T17:50:40Z

Although I can't seem to use it with a browser

[parker@nintendoswitch rdrview-git]$ rdrview -B links 'https://github.com/eafer/rdrview' 
rdrview: Operation not permitted
[parker@nintendoswitch rdrview-git]$ rdrview -B lynx 'https://github.com/eafer/rdrview' 
rdrview: Operation not permitted

Gist of strace (See next message) ~~https://gist.github.com/1bf87765d716ce60b011dd1a633132cf~~

parkerlreed · 2021-01-29T17:54:00Z

Forgot to do the follow-forks https://gist.github.com/2948087883f55cccd44164fb9745ffa0

9214  dup(1)                            = 4
9214  dup3(3, 1, 0)                     = -1 EPERM (Operation not permitted)
9214  dup(2)                            = 6
9214  fcntl(6, F_GETFL)                 = -1 EPERM (Operation not permitted)
9214  close(6)                          = 0
9214  write(2, "rdrview: Operation not permitted"..., 33) = 33

I have no idea why, but it seems that dup2() is sometimes implemented internally using the dup3() syscall: #14 (comment) So add that syscall to the allowed list.

eafer · 2021-01-29T20:43:52Z

Although I can't seem to use it with a browser

It seems that your standard library implements dup2() using the dup3() syscall instead. I'm pushing a patch to allow dup3(), let me know if it's not enough.

parkerlreed · 2021-01-29T20:59:11Z

Works great! Thanks.

Since I forgot to mention: That's Arch Linux ARM (aarch64)

ghost · 2021-02-09T01:03:54Z

I don't know if this is an issue worthy of it's own thread, but I was having a similar issue on x64 Arch Linux, so I ran the strace previously posted here and got the following errors

[pid 2026874] newfstatat(5, "", 0x7ffd80399170, AT_EMPTY_PATH) = -1 EPERM (Operation not permitted)
[pid 2026874] fcntl(4, F_GETFL)         = -1 EPERM (Operation not permitted)

So I tried adding the following lines to my sandbox.c and it worked perfectly.

	fail |= seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(newfstatat), 0);
	fail |= seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(fcntl), 0);

eafer · 2021-02-13T23:35:55Z

[pid 2026874] newfstatat(5, "", 0x7ffd80399170, AT_EMPTY_PATH) = -1 EPERM (Operation not permitted)

Thank you for the report. It seems that your libc implements fstat() using a variation of fstatat(). I can't just allow fstatat() because it's called with a path, not with a file descriptor, so it's too dangerous. This is all very annoying: I think I will have to write my own wrapper...

It's been reported that some standard libraries implement fstat() using the newfstatat() syscall: #14 (comment) This is a very annoying: if I allow newfstatat(), an attacker running code inside the sandbox would be able to get information about any filepath. Instead, restructure the code so that the only call to fstat() happens before the sandbox is set up, and ban all variants of this syscall (as well as mmap(), which is no longer needed either).

eafer · 2021-02-14T00:58:32Z

[pid 2026874] newfstatat(5, "", 0x7ffd80399170, AT_EMPTY_PATH) = -1 EPERM (Operation not permitted)

Ok, I'm just moving the call to fstat() outside the sandbox. That doesn't carry any risk, and it should make all these problems go away. Please let me know if it works for you.

yuuyins · 2021-08-17T23:42:24Z

I'm facing the same issue (or at least seems like the same). But I'm on x86_64-linux (NixOS). only --disable-sandbox works

eafer · 2021-08-20T03:40:30Z

I'm facing the same issue (or at least seems like the same). But I'm on x86_64-linux (NixOS). only --disable-sandbox works

Can you run

strace -f rdrview -H 'https://github.com/eafer/rdrview' 2>&1 >/dev/null | grep EPERM

and send me the output?

yuuyins · 2021-08-20T12:09:36Z

@eafer

[pid 435094] newfstatat(5, "", 0x7ffc3cf6a770, AT_EMPTY_PATH) = -1 EPERM (Operation not permitted)
[pid 435094] fcntl(4, F_GETFL)          = -1 EPERM (Operation not permitted)

PS: I'm using 7be01fb

eafer · 2021-08-20T22:02:28Z

PS: I'm using 7be01fb

In that case, I think this issue has already been fixed. Try the current head.

yuuyins · 2021-08-21T21:22:39Z

@eafer tested with rev 444ce3d and the issue is no longer. I previously hadn't checked if Nix package was up to date, sorry about this.

eafer · 2021-08-23T17:58:01Z

@eafer tested with rev 444ce3d and the issue is no longer. I previously hadn't checked if Nix package was up to date, sorry about this.

No problem, I'm glad it works.

m040601 changed the title ~~"Operation not permitted" on ARM~~ "Operation not permitted": on ARM it only runs with "disable-sandbox" Jan 24, 2021

eafer added a commit that referenced this issue Jan 29, 2021

Allow the dup3() syscall on Linux

f986063

I have no idea why, but it seems that dup2() is sometimes implemented internally using the dup3() syscall: #14 (comment) So add that syscall to the allowed list.

tathastu871 mentioned this issue Dec 24, 2021

[Bug]: rdrview with seccomp always (?) terminates with exit code 127, without showing any output termux/termux-packages#8328

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

"Operation not permitted": on ARM it only runs with "disable-sandbox" #14

"Operation not permitted": on ARM it only runs with "disable-sandbox" #14

m040601 commented Jan 24, 2021 •

edited

eafer commented Jan 25, 2021 via email

m040601 commented Jan 26, 2021

eafer commented Jan 26, 2021 via email

m040601 commented Jan 27, 2021 •

edited

eafer commented Jan 27, 2021 via email

m040601 commented Jan 28, 2021

parkerlreed commented Jan 29, 2021 •

edited

parkerlreed commented Jan 29, 2021 •

edited

parkerlreed commented Jan 29, 2021 •

edited

eafer commented Jan 29, 2021 via email

parkerlreed commented Jan 29, 2021

ghost commented Feb 9, 2021

eafer commented Feb 13, 2021 via email

eafer commented Feb 14, 2021 via email

yuuyins commented Aug 17, 2021

eafer commented Aug 20, 2021

yuuyins commented Aug 20, 2021

eafer commented Aug 20, 2021

yuuyins commented Aug 21, 2021

eafer commented Aug 23, 2021 via email

"Operation not permitted": on ARM it only runs with "disable-sandbox" #14

"Operation not permitted": on ARM it only runs with "disable-sandbox" #14

Comments

m040601 commented Jan 24, 2021 • edited

eafer commented Jan 25, 2021 via email

m040601 commented Jan 26, 2021

eafer commented Jan 26, 2021 via email

m040601 commented Jan 27, 2021 • edited

eafer commented Jan 27, 2021 via email

m040601 commented Jan 28, 2021

parkerlreed commented Jan 29, 2021 • edited

parkerlreed commented Jan 29, 2021 • edited

parkerlreed commented Jan 29, 2021 • edited

eafer commented Jan 29, 2021 via email

parkerlreed commented Jan 29, 2021

ghost commented Feb 9, 2021

eafer commented Feb 13, 2021 via email

eafer commented Feb 14, 2021 via email

yuuyins commented Aug 17, 2021

eafer commented Aug 20, 2021

yuuyins commented Aug 20, 2021

eafer commented Aug 20, 2021

yuuyins commented Aug 21, 2021

eafer commented Aug 23, 2021 via email

m040601 commented Jan 24, 2021 •

edited

m040601 commented Jan 27, 2021 •

edited

parkerlreed commented Jan 29, 2021 •

edited

parkerlreed commented Jan 29, 2021 •

edited

parkerlreed commented Jan 29, 2021 •

edited