Skip to content

Commit

Permalink
Disable seccomp allow rule for faccessat2 for now
Browse files Browse the repository at this point in the history
For some reason seccomp_syscall_resolve_name() returns __NR_SCMP_ERROR
on this. Guess indicating it doesn't know about the whole thing rather
that it doesn't exist for the current architecture.

Anyhow as this and couple other syscalls are new additions to 3.2,
we shouldn't be worse than earlier versions if we just skip it for now.
  • Loading branch information
pvuorela committed Sep 28, 2021
1 parent 7c54930 commit 1ffc0f5
Show file tree
Hide file tree
Showing 9 changed files with 39 additions and 7 deletions.
2 changes: 1 addition & 1 deletion rpm/0001-Tracker-config-overrides.patch
@@ -1,7 +1,7 @@
From aae99517e9159f9eb7980fb1e7e53606c8b8a04f Mon Sep 17 00:00:00 2001
From: Islam Amer <islam.amer@jollamobile.com>
Date: Wed, 12 Nov 2014 18:10:53 +0200
Subject: [PATCH 1/7] Tracker config overrides
Subject: [PATCH 1/8] Tracker config overrides

[schema] change default miner initial sleep to 30 seconds to not hammer the system during bootup
Set the default delay for GraphUpdated to 350 instead of upstream default of 1000. Helps fixing JB#11570
Expand Down
2 changes: 1 addition & 1 deletion rpm/0002-Fix-systemd-unit-files.patch
@@ -1,7 +1,7 @@
From 2032310bf3bcfe3eb2822dab1a1a22b8fc234add Mon Sep 17 00:00:00 2001
From: Matti Kosola <matti.kosola@jolla.com>
Date: Tue, 14 Aug 2018 09:35:50 -0400
Subject: [PATCH 2/7] Fix systemd unit files
Subject: [PATCH 2/8] Fix systemd unit files

Signed-off-by: Matti Kosola <matti.kosola@jolla.com>
---
Expand Down
@@ -1,7 +1,7 @@
From 67ce4e797a59d6c6ac5577e150aba80b4d2928d4 Mon Sep 17 00:00:00 2001
From: Andrew Branson <andrew.branson@jolla.com>
Date: Fri, 28 Aug 2020 00:04:51 +0200
Subject: [PATCH 3/7] Prevent tracker-extract failing when seccomp loading
Subject: [PATCH 3/8] Prevent tracker-extract failing when seccomp loading
fails on older kernels. JB#50862

---
Expand Down
@@ -1,7 +1,7 @@
From a2f3a944b9986d4a92f1333049027e7eb99d15dc Mon Sep 17 00:00:00 2001
From: Pekka Vuorela <pekka.vuorela@jolla.com>
Date: Wed, 19 May 2021 13:26:07 +0300
Subject: [PATCH 4/7] Add also fileSize to the basic set of file info on all
Subject: [PATCH 4/8] Add also fileSize to the basic set of file info on all
the graph

No need to depend on FileSystem graph to have the sizes.
Expand Down
@@ -1,7 +1,7 @@
From 8b4374744c566561c0fa4dd45139b79df0667c37 Mon Sep 17 00:00:00 2001
From: Pekka Vuorela <pekka.vuorela@jolla.com>
Date: Wed, 7 Jul 2021 13:05:57 +0300
Subject: [PATCH 5/7] Fix database corruption caused by the miner being
Subject: [PATCH 5/8] Fix database corruption caused by the miner being
restarted during setup.

Install the signal handlers before starting database setup so if the
Expand Down
2 changes: 1 addition & 1 deletion rpm/0006-Allow-D-Bus-activation-only-through-systemd.patch
@@ -1,7 +1,7 @@
From f629b2ef69bf24932bc85cc8314208983a652525 Mon Sep 17 00:00:00 2001
From: Simo Piiroinen <simo.piiroinen@jolla.com>
Date: Thu, 12 Aug 2021 08:26:21 +0300
Subject: [PATCH 6/7] Allow D-Bus activation only through systemd
Subject: [PATCH 6/8] Allow D-Bus activation only through systemd

Starting D-Bus services should happen only via systemd. Using a dummy
Exec line in D-Bus configuration ensures that systemd can't be bypassed.
Expand Down
@@ -1,7 +1,7 @@
From 739d32a1cbbe9b243841a3ba8902517fd11ce02d Mon Sep 17 00:00:00 2001
From: Pekka Vuorela <pekka.vuorela@jolla.com>
Date: Tue, 21 Sep 2021 19:38:08 +0300
Subject: [PATCH 7/7] Update nfo:fileLastModified also on content specific
Subject: [PATCH 7/8] Update nfo:fileLastModified also on content specific
graphs

Executing 'touch' on a file was updating only tracker:FileSystem.
Expand Down
31 changes: 31 additions & 0 deletions rpm/0008-Disable-seccomp-allow-rule-for-faccessat2-for-now.patch
@@ -0,0 +1,31 @@
From c5683df715f26500453cc963c70b8a84366c17c3 Mon Sep 17 00:00:00 2001
From: Pekka Vuorela <pekka.vuorela@jolla.com>
Date: Tue, 28 Sep 2021 14:14:13 +0300
Subject: [PATCH 8/8] Disable seccomp allow rule for faccessat2 for now

For some reason seccomp_syscall_resolve_name() returns __NR_SCMP_ERROR
on this. Guess indicating it doesn't know about the whole thing rather
that it doesn't exist for the current architecture.

Anyhow as this and couple other syscalls are new additions to 3.2,
we shouldn't be worse than earlier versions if we just skip it for now.
---
src/libtracker-miners-common/tracker-seccomp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libtracker-miners-common/tracker-seccomp.c b/src/libtracker-miners-common/tracker-seccomp.c
index 47b555d65..60a0c4255 100644
--- a/src/libtracker-miners-common/tracker-seccomp.c
+++ b/src/libtracker-miners-common/tracker-seccomp.c
@@ -141,7 +141,7 @@ tracker_seccomp_init (void)
ALLOW_RULE (statx);
ALLOW_RULE (access);
ALLOW_RULE (faccessat);
- ALLOW_RULE (faccessat2);
+// ALLOW_RULE (faccessat2);
ALLOW_RULE (getdents);
ALLOW_RULE (getdents64);
ALLOW_RULE (readlink);
--
2.31.1

1 change: 1 addition & 0 deletions rpm/tracker-miners.spec
Expand Up @@ -14,6 +14,7 @@ Patch4: 0004-Add-also-fileSize-to-the-basic-set-of-file-info-on-a.patch
Patch5: 0005-Fix-database-corruption-caused-by-the-miner-being-re.patch
Patch6: 0006-Allow-D-Bus-activation-only-through-systemd.patch
Patch7: 0007-Update-nfo-fileLastModified-also-on-content-specific.patch
Patch8: 0008-Disable-seccomp-allow-rule-for-faccessat2-for-now.patch

BuildRequires: meson >= 0.50
BuildRequires: gettext
Expand Down

0 comments on commit 1ffc0f5

Please sign in to comment.