linux-user, fix: Handle AT_FDCWD when hiding helper threads - #463
Open
y347812075 wants to merge 2 commits into
Open
linux-user, fix: Handle AT_FDCWD when hiding helper threads#463y347812075 wants to merge 2 commits into
y347812075 wants to merge 2 commits into
Conversation
Chromium's namespace sandbox keeps procfs directory descriptors across a shared chroot. Once the absolute /proc path becomes unreachable, LATX no longer recognized /proc/self/task and exposed its host-only RCU helper in st_nlink. ChatGPT 42.3.0 then failed the zygote thread-count check and triggered INT3 unless launched with --no-sandbox. Recognize saved current-process task descriptors by comparing their procfs device and inode with ../../self/task. Apply the guest thread count to fstat, fstatat with AT_EMPTY_PATH, and statx while leaving other processes' task directories unchanged. Add a focused x86_64 guest regression and a native two-thread helper covering saved proc root and task descriptors, AT_EMPTY_PATH, statx, and the other-PID negative case. Validated with the focused procfs and namespace integration tests and three ChatGPT default-sandbox launches reaching "Launching app" without INT3. Signed-off-by: yuerengan <y347812075@163.com>
stat-family calls may resolve /proc/self/task through absolute, relative, or empty paths after a shared sandbox chroot. Those accesses could expose LATX-only helper threads in st_nlink. Snapshot guest pathnames before host at-calls and serialize identity-sensitive stat operations with guest cwd, root, mount, and fd-binding changes. Resolve relative self-task identity through the original dirfd and snapshot without creating translator-owned descriptors in the guest fd table. Carry the serialization lock safely across fork. Extend the chroot regression with alternate relative spellings and concurrent cwd, dirfd, pathname, and root changes, while retaining negative coverage for other processes and ordinary directories. Validated with x86_64 and i386 builds, repeated focused procfs races, proc thread-count and userns exec coverage, and the i386 fd-transform fork race. Signed-off-by: yuerengan <y347812075@163.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Depends on #419. This is a stacked follow-up; review commit
36c629ac348b4e27be4d9565a71a032958905597.Summary
AT_EMPTY_PATHstat-family lookups throughAT_FDCWDafter a shared sandbox chrootValidation
ninja -C build64 latx-x86_64ninja -C build32 latx-i386TMPDIR="$HOME/tmp" tests/integration/test-cef-procfs-chroot.sh ...(three consecutive passes)TMPDIR="$HOME/tmp" tests/integration/test-proc-thread-count.sh ...TMPDIR="$HOME/tmp" tests/integration/test-cef-userns-exec.sh ...TMPDIR="$HOME/tmp" tests/integration/test-fd-transform-race-i386.sh ...scripts/checkpatch.pl --no-tree --strict --no-signoff: 0 errors, 0 warningstest-cef-userns-nested.shretains the pre-existinglongjmp causes uninitialized stack framefailure and exits 12; the same failure is present without this patch.