Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Outdated zipjail binary #50

Open
nazywam opened this issue Aug 4, 2020 · 0 comments
Open

Outdated zipjail binary #50

nazywam opened this issue Aug 4, 2020 · 0 comments

Comments

@nazywam
Copy link

nazywam commented Aug 4, 2020

The compiled zipjail binary on the master branch is outdated (version 0.5 vs 0.5.2 from the tracy project master)
As a result, its syscall whitelist is missing getdents64 and getpid:
sflock master:

.rodata:000000000049B914 aGettimeofday   db 'gettimeofday',0     ; DATA XREF: .data:00000000006C81C0↓o
.rodata:000000000049B921 aStat64         db 'stat64',0           ; DATA XREF: .data:00000000006C81C8↓o
.rodata:000000000049B928 aSysDevicesSyst_1 db '/sys/devices/system/cpu',0

compiled tracy master:

.rodata:000000000049F0B4 aGettimeofday   db 'gettimeofday',0     ; DATA XREF: .data:00000000004CE1C0↓o
.rodata:000000000049F0C1 aStat64         db 'stat64',0           ; DATA XREF: .data:00000000004CE1C8↓o
.rodata:000000000049F0C8 aGetdents64     db 'getdents64',0       ; DATA XREF: .data:00000000004CE1D0↓o
.rodata:000000000049F0D3 aGetpid_0       db 'getpid',0           ; DATA XREF: .data:00000000004CE1D8↓o
.rodata:000000000049F0DA aSysDevicesSyst_1 db '/sys/devices/system/cpu',0

This will cause some archives to be incorrectly dropped: (unpacking an iso archive using 7zip)

ERROR:root:Blocked system call occurred during sandboxing!
ip=0x7fd816c6d07b sp=0x7fffbe193978 abi=0 nr=217 syscall=getdents64
Killing child 7064
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant