subgraph / oz

OZ: a sandboxing system targeting everyday workstation applications
https://subgraph.com/sgos/
Other
432 stars 57 forks source link

Suddenly everything in Oz needs to call mount(2), including Oz itself #61

Closed dma closed 8 years ago

dma commented 8 years ago

Oz is broken completely after an apt-get upgrade as of May 2 2016 because of this. Xorg calls mount(2), eog calls mount(2), IceDove, TorBrowser, torbrowser-launcher, evince..

[ 26.369901] audit: type=1326 audit(1462200225.191:69): auid=4294967295 uid=1000 gid=1000 ses=4294967295 pid=1469 comm="Xorg" exe="/usr/lib/xorg/Xorg" sig=31 arch=c000003e syscall=165 compat=0 ip=0x35da34e566a code=0x0 [ 204.105243] audit: type=1326 audit(1462200402.915:70): auid=4294967295 uid=1000 gid=1000 ses=4294967295 pid=1680 comm="torbrowser-laun" exe="/usr/bin/python2.7" sig=31 arch=c000003e syscall=165 compat=0 ip=0x354c9a2f66a code=0x0 [ 329.131115] audit: type=1326 audit(1462200527.935:72): auid=4294967295 uid=1000 gid=1000 ses=4294967295 pid=2068 comm="icedove" exe="/usr/lib/icedove/icedove" sig=31 arch=c000003e syscall=165 compat=0 ip=0x34e9e68266a code=0x0 [ 371.534689] audit: type=1326 audit(1462200570.339:73): auid=4294967295 uid=1000 gid=1000 ses=4294967295 pid=2419 comm="eog" exe="/usr/bin-oz/eog" sig=31 arch=c000003e syscall=165 compat=0 ip=0x360783cc66a code=0x0 [ 376.725000] audit: type=1326 audit(1462200575.527:74): auid=4294967295 uid=1000 gid=1000 ses=4294967295 pid=2656 comm="evince" exe="/usr/bin-oz/evince" sig=31 arch=c000003e syscall=165 compat=0 ip=0x34033cf766a code=0x0 [ 444.349151] audit: type=1326 audit(1462200643.151:75): auid=4294967295 uid=1000 gid=1000 ses=4294967295 pid=2824 comm="coyim" exe="/usr/bin-oz/coyim" sig=31 arch=c000003e syscall=165 compat=0 ip=0x356da17a66a code=0x0

Seems they're all trying to do this -- not yet sure where it's coming from:

2942 mount("proc", "/proc", "proc", 0, NULL) = -1 EPERM (Operation not permitted)

The generic blacklist + all the individual whitelists need to be updated.

xSmurf commented 8 years ago

Problem with libc upstream has been fixed.