Skip to content

Commit

Permalink
os: ignore SIGSYS in checkPidfd
Browse files Browse the repository at this point in the history
In Android version 11 and earlier, pidfd-related system calls
are not allowed by the seccomp policy, which causes crashes due
to SIGSYS signals.

Fixes golang#69065
  • Loading branch information
cions committed Sep 24, 2024
1 parent 165bf24 commit aad6b3b
Show file tree
Hide file tree
Showing 4 changed files with 51 additions and 2 deletions.
16 changes: 16 additions & 0 deletions src/os/pidfd_linux.go
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ package os
import (
"errors"
"internal/syscall/unix"
"runtime"
"sync"
"syscall"
"unsafe"
Expand Down Expand Up @@ -151,6 +152,13 @@ var checkPidfdOnce = sync.OnceValue(checkPidfd)
// execution environment in which the above system calls are restricted by
// seccomp or a similar technology.
func checkPidfd() error {
// In Android version < 12, pidfd-related system calls are not allowed
// by seccomp and trigger the SIGSYS signal. See issue #69065.
if runtime.GOOS == "android" {
ignoreSIGSYS()
defer restoreSIGSYS()
}

// Get a pidfd of the current process (opening of "/proc/self" won't
// work for waitid).
fd, err := unix.PidFDOpen(syscall.Getpid(), 0)
Expand Down Expand Up @@ -192,3 +200,11 @@ func checkPidfd() error {
//
//go:linkname checkClonePidfd
func checkClonePidfd() error

// Provided by runtime.
//
//go:linkname ignoreSIGSYS
func ignoreSIGSYS()

//go:linkname restoreSIGSYS
func restoreSIGSYS()
13 changes: 11 additions & 2 deletions src/runtime/os_linux.go
Original file line number Diff line number Diff line change
Expand Up @@ -879,8 +879,9 @@ func runPerThreadSyscall() {
}

const (
_SI_USER = 0
_SI_TKILL = -6
_SI_USER = 0
_SI_TKILL = -6
_SYS_SECCOMP = 1
)

// sigFromUser reports whether the signal was sent because of a call
Expand All @@ -892,6 +893,14 @@ func (c *sigctxt) sigFromUser() bool {
return code == _SI_USER || code == _SI_TKILL
}

// sigFromSeccomp reports whether the signal was sent from seccomp.
//
//go:nosplit
func (c *sigctxt) sigFromSeccomp() bool {
code := int32(c.sigcode())
return code == _SYS_SECCOMP
}

//go:nosplit
func mprotect(addr unsafe.Pointer, n uintptr, prot int32) (ret int32, errno int32) {
r, _, err := syscall.Syscall6(syscall.SYS_MPROTECT, uintptr(addr), n, uintptr(prot), 0, 0, 0)
Expand Down
7 changes: 7 additions & 0 deletions src/runtime/os_unix_nonlinux.go
Original file line number Diff line number Diff line change
Expand Up @@ -13,3 +13,10 @@ package runtime
func (c *sigctxt) sigFromUser() bool {
return c.sigcode() == _SI_USER
}

// sigFromSeccomp reports whether the signal was sent from seccomp.
//
//go:nosplit
func (c *sigctxt) sigFromSeccomp() bool {
return false
}
17 changes: 17 additions & 0 deletions src/runtime/signal_unix.go
Original file line number Diff line number Diff line change
Expand Up @@ -605,6 +605,19 @@ var crashing atomic.Int32
var testSigtrap func(info *siginfo, ctxt *sigctxt, gp *g) bool
var testSigusr1 func(gp *g) bool

// sigsysIgnored is non-zero if we are currently ignoring SIGSYS. See issue #69065.
var sigsysIgnored uint32

//go:linkname ignoreSIGSYS os.ignoreSIGSYS
func ignoreSIGSYS() {
atomic.Store(&sigsysIgnored, 1)
}

//go:linkname restoreSIGSYS os.restoreSIGSYS
func restoreSIGSYS() {
atomic.Store(&sigsysIgnored, 0)
}

// sighandler is invoked when a signal occurs. The global g will be
// set to a gsignal goroutine and we will be running on the alternate
// signal stack. The parameter gp will be the value of the global g
Expand Down Expand Up @@ -715,6 +728,10 @@ func sighandler(sig uint32, info *siginfo, ctxt unsafe.Pointer, gp *g) {
return
}

if sig == _SIGSYS && c.sigFromSeccomp() && atomic.Load(&sigsysIgnored) != 0 {
return
}

if flags&_SigKill != 0 {
dieFromSignal(sig)
}
Expand Down

0 comments on commit aad6b3b

Please sign in to comment.