[gentoo-commits] repo/gentoo:master commit in: sys-apps/file/files/, sys-apps/file/

[Mike Gilbert]

commit:     0813d843cb2a43c748fdf6c9d5ac6dc882104dcf
Author:     Mike Gilbert <floppym <AT> gentoo <DOT> org>
AuthorDate: Fri Apr 23 19:10:09 2021 +0000
Commit:     Mike Gilbert <floppym <AT> gentoo <DOT> org>
CommitDate: Fri Apr 23 19:10:09 2021 +0000
URL:        https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0813d843

sys-apps/file: allow faccessat and fstatat64 syscalls

Closes: https://bugs.gentoo.org/784857
Signed-off-by: Mike Gilbert <floppym <AT> gentoo.org>

 .../{file-5.40-r1.ebuild => file-5.40-r2.ebuild}   |  2 ++
 .../file/files/file-5.40-seccomp-faccessat.patch   | 34 ++++++++++++++++++++++
 .../file/files/file-5.40-seccomp-fstatat64.patch   | 29 ++++++++++++++++++
 3 files changed, 65 insertions(+)

diff --git a/sys-apps/file/file-5.40-r1.ebuild b/sys-apps/file/file-5.40-r2.ebuild
similarity index 96%
rename from sys-apps/file/file-5.40-r1.ebuild
rename to sys-apps/file/file-5.40-r2.ebuild
index a901c2a4003..f46a59bccfa 100644
--- a/sys-apps/file/file-5.40-r1.ebuild
+++ b/sys-apps/file/file-5.40-r2.ebuild
@@ -39,6 +39,8 @@ RDEPEND="${DEPEND}
 PATCHES=(
 	"${FILESDIR}/file-5.39-portage-sandbox.patch" #713710 #728978
 	"${FILESDIR}/file-5.40-xz_magic.patch" #784773
+	"${FILESDIR}/file-5.40-seccomp-faccessat.patch"
+	"${FILESDIR}/file-5.40-seccomp-fstatat64.patch" #784857
 )
 
 src_prepare() {

diff --git a/sys-apps/file/files/file-5.40-seccomp-faccessat.patch b/sys-apps/file/files/file-5.40-seccomp-faccessat.patch
new file mode 100644
index 00000000000..4aeb88cfe87
--- /dev/null
+++ b/sys-apps/file/files/file-5.40-seccomp-faccessat.patch
@@ -0,0 +1,34 @@
+From abcd583135bb0762e6bfd0f2e06c50bea1fb3cd0 Mon Sep 17 00:00:00 2001
+From: Christos Zoulas <christos@××××××.com>
+Date: Tue, 6 Apr 2021 22:02:17 +0000
+Subject: [PATCH] On ARM64 Linux access() syscall is no longer a real syscall
+ to the kernel. Instead it's emulated by glibc with a new faccessat() syscall.
+ (Icenowy Zheng)
+
+---
+ src/seccomp.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/src/seccomp.c b/src/seccomp.c
+index 0da907ff7..81842cf5c 100644
+--- a/src/seccomp.c
++++ b/src/seccomp.c
+@@ -27,7 +27,7 @@
+ #include "file.h"
+ 
+ #ifndef	lint
+-FILE_RCSID("@(#)$File: seccomp.c,v 1.18 2021/03/14 17:01:58 christos Exp $")
++FILE_RCSID("@(#)$File: seccomp.c,v 1.19 2021/04/06 22:02:17 christos Exp $")
+ #endif	/* lint */
+ 
+ #if HAVE_LIBSECCOMP
+@@ -171,6 +171,9 @@ enable_sandbox_full(void)
+ 	ALLOW_RULE(dup2);
+ 	ALLOW_RULE(exit);
+ 	ALLOW_RULE(exit_group);
++#ifdef __NR_faccessat
++	ALLOW_RULE(faccessat);
++#endif
+ 	ALLOW_RULE(fcntl);
+  	ALLOW_RULE(fcntl64);
+ 	ALLOW_RULE(fstat);

diff --git a/sys-apps/file/files/file-5.40-seccomp-fstatat64.patch b/sys-apps/file/files/file-5.40-seccomp-fstatat64.patch
new file mode 100644
index 00000000000..57d04e5f40c
--- /dev/null
+++ b/sys-apps/file/files/file-5.40-seccomp-fstatat64.patch
@@ -0,0 +1,29 @@
+From e3d0265a147878b6c2903bcc83b9842dff68ceb4 Mon Sep 17 00:00:00 2001
+From: Mike Gilbert <floppym@g.o>
+Date: Fri, 23 Apr 2021 15:00:42 -0400
+Subject: [PATCH] seccomp: allow fstatat64
+
+This is needed for the libsandbox LD_PRELOAD wrapper on Gentoo Linux.
+
+Bug: https://bugs.gentoo.org/784857
+---
+ src/seccomp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/seccomp.c b/src/seccomp.c
+index 81842cf5..43abc684 100644
+--- a/src/seccomp.c
++++ b/src/seccomp.c
+@@ -178,6 +178,9 @@ enable_sandbox_full(void)
+  	ALLOW_RULE(fcntl64);
+ 	ALLOW_RULE(fstat);
+  	ALLOW_RULE(fstat64);
++#ifdef __NR_fstatat64
++	ALLOW_RULE(fstatat64);
++#endif
+ 	ALLOW_RULE(futex);
+ 	ALLOW_RULE(getdents);
+ #ifdef __NR_getdents64
+-- 
+2.31.1
+