glibc/sysdeps/unix
H.J. Lu d8ea0d0168 Add an internal wrapper for clone, clone2 and clone3
The clone3 system call (since Linux 5.3) provides a superset of the
functionality of clone and clone2.  It also provides a number of API
improvements, including the ability to specify the size of the child's
stack area which can be used by kernel to compute the shadow stack size
when allocating the shadow stack.  Add:

extern int __clone_internal (struct clone_args *__cl_args,
			     int (*__func) (void *__arg), void *__arg);

to provide an abstract interface for clone, clone2 and clone3.

1. Simplify stack management for thread creation by passing both stack
base and size to create_thread.
2. Consolidate clone vs clone2 differences into a single file.
3. Call __clone3 if HAVE_CLONE3_WAPPER is defined.  If __clone3 returns
-1 with ENOSYS, fall back to clone or clone2.
4. Use only __clone_internal to clone a thread.  Since the stack size
argument for create_thread is now unconditional, always pass stack size
to create_thread.
5. Enable the public clone3 wrapper in the future after it has been
added to all targets.

NB: Sandbox will return ENOSYS on clone3 in both Chromium:

The following revision refers to this bug:
  218438259d

commit 218438259dd795456f0a48f67cbe5b4e520db88b
Author: Matthew Denton <mpdenton@chromium.org>
Date: Thu Jun 03 20:06:13 2021

Linux sandbox: return ENOSYS for clone3

Because clone3 uses a pointer argument rather than a flags argument, we
cannot examine the contents with seccomp, which is essential to
preventing sandboxed processes from starting other processes. So, we
won't be able to support clone3 in Chromium. This CL modifies the
BPF policy to return ENOSYS for clone3 so glibc always uses the fallback
to clone.

Bug: 1213452
Change-Id: I7c7c585a319e0264eac5b1ebee1a45be2d782303
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2936184
Reviewed-by: Robert Sesek <rsesek@chromium.org>
Commit-Queue: Matthew Denton <mpdenton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#888980}

[modify] https://crrev.com/218438259dd795456f0a48f67cbe5b4e520db88b/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc

and Firefox:

https://hg.mozilla.org/integration/autoland/rev/ecb4011a0c76

Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
2021-07-14 06:33:58 -07:00
..
alpha Update copyright dates with scripts/update-copyrights 2021-01-02 12:17:34 -08:00
arm Update copyright dates with scripts/update-copyrights 2021-01-02 12:17:34 -08:00
bsd login: Hidden prototypes for _getpt, __ptsname_r, grantpt, unlockpt 2021-06-30 07:28:12 +02:00
i386 Update copyright dates with scripts/update-copyrights 2021-01-02 12:17:34 -08:00
inet Remove obsolete, never-implemented XSI STREAMS declarations 2019-03-14 15:44:15 +01:00
mips Update copyright dates with scripts/update-copyrights 2021-01-02 12:17:34 -08:00
powerpc Update copyright dates with scripts/update-copyrights 2021-01-02 12:17:34 -08:00
sh Update copyright dates with scripts/update-copyrights 2021-01-02 12:17:34 -08:00
sysv/linux Add an internal wrapper for clone, clone2 and clone3 2021-07-14 06:33:58 -07:00
x86_64 Update copyright dates with scripts/update-copyrights 2021-01-02 12:17:34 -08:00
confstr.h
get_child_max.c Update copyright dates with scripts/update-copyrights 2021-01-02 12:17:34 -08:00
getlogin_r.c Update copyright dates with scripts/update-copyrights 2021-01-02 12:17:34 -08:00
getlogin.c Update copyright dates with scripts/update-copyrights 2021-01-02 12:17:34 -08:00
getpagesize.c Update copyright dates with scripts/update-copyrights 2021-01-02 12:17:34 -08:00
grantpt.c login: Hidden prototypes for _getpt, __ptsname_r, grantpt, unlockpt 2021-06-30 07:28:12 +02:00
ifreq.c Update copyright dates with scripts/update-copyrights 2021-01-02 12:17:34 -08:00
Implies
make-syscalls.sh Add SYSCALL_ULONG_ARG_[12] to pass long to syscall [BZ #25810] 2020-04-29 05:35:34 -07:00
Makefile Update copyright dates with scripts/update-copyrights 2021-01-02 12:17:34 -08:00
s-proto-cancel.S
s-proto.S
setxid.h
sockatmark.c Update copyright dates with scripts/update-copyrights 2021-01-02 12:17:34 -08:00
syscall-template.S Update copyright dates with scripts/update-copyrights 2021-01-02 12:17:34 -08:00
syscall.S Update copyright dates with scripts/update-copyrights 2021-01-02 12:17:34 -08:00
syscalls.list signal: Add __libc_sigaction 2021-03-18 15:54:39 -03:00
sysdep.h Linux: Explicitly disable cancellation checking in the dynamic loader 2021-05-10 10:31:41 +02:00