Ubuntu
chromium-browser package

[snap] seccomp denials for syscall=312,314,330 on amd64

Bug #1969141 reported by Simon Déziel
12
This bug affects 2 people
Affects Status Importance Assigned to Milestone
chromium-browser (Ubuntu)
Confirmed
Low
Unassigned
snapd (Ubuntu)
New
Undecided
Unassigned

Bug Description

# Steps to reproduce

1) Install Chromium's snap
snap install chromium
2) Monitor logs
journalctl -o cat -f --grep chromium
3) Start Chromium

journalctl will be filled with errors due to some syscalls not permitted by the seccomp policy, like those:

Apr 14 11:18:14 sdeziel-lemur audit[1734639]: SECCOMP auid=1000 uid=1000 gid=1000 ses=3 subj=snap.chromium.chromium pid=1734639 comm="chrome" exe="/snap/chromium/1961/usr/lib/chromium-browser/chrome" sig=0 arch=c000003e syscall=314 compat=0 ip=0x77ccfac2276d code=0x50000
Apr 14 11:18:14 sdeziel-lemur audit[1734751]: SECCOMP auid=1000 uid=1000 gid=1000 ses=3 subj=snap.chromium.chromium pid=1734751 comm="chrome" exe="/snap/chromium/1961/usr/lib/chromium-browser/chrome" sig=0 arch=c000003e syscall=312 compat=0 ip=0x7a9d5be7f76d code=0x50000
Apr 14 11:18:14 sdeziel-lemur audit[1734790]: SECCOMP auid=1000 uid=1000 gid=1000 ses=3 subj=snap.chromium.chromium pid=1734790 comm="chrome" exe="/snap/chromium/1961/usr/lib/chromium-browser/chrome" sig=0 arch=c000003e syscall=330 compat=0 ip=0x735f8ecd303b code=0x50000

# Additional information
$ uname -a
Linux sdeziel-lemur 5.13.0-39-generic #44~20.04.1-Ubuntu SMP Thu Mar 24 16:43:35 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
$ lsb_release -rd
Description: Ubuntu 20.04.4 LTS
Release: 20.04
$ snap list chromium
Name Version Rev Tracking Publisher Notes
chromium 100.0.4896.88 1961 latest/stable canonical✓ -

$ snap connections chromium
Interface Plug Slot Notes
audio-playback chromium:audio-playback :audio-playback -
audio-record chromium:audio-record :audio-record -
bluez chromium:bluez :bluez -
browser-support chromium:browser-sandbox :browser-support -
camera chromium:camera :camera manual
content[gnome-3-38-2004] chromium:gnome-3-38-2004 gnome-3-38-2004:gnome-3-38-2004 -
content[gtk-3-themes] chromium:gtk-3-themes gtk-common-themes:gtk-3-themes -
content[icon-themes] chromium:icon-themes gtk-common-themes:icon-themes -
content[sound-themes] chromium:sound-themes gtk-common-themes:sound-themes -
cups-control chromium:cups-control :cups-control -
desktop chromium:desktop :desktop -
desktop-legacy chromium:desktop-legacy :desktop-legacy -
gsettings chromium:gsettings :gsettings -
home chromium:home :home -
joystick chromium:joystick :joystick -
mount-observe chromium:mount-observe - -
mpris - chromium:mpris -
network chromium:network :network -
network-bind chromium:network-bind :network-bind -
network-manager chromium:network-manager - -
opengl chromium:opengl :opengl -
password-manager-service chromium:password-manager-service - -
personal-files chromium:chromium-config :personal-files -
pulseaudio chromium:pulseaudio - -
raw-usb chromium:raw-usb - -
removable-media chromium:removable-media :removable-media -
screen-inhibit-control chromium:screen-inhibit-control :screen-inhibit-control -
system-files chromium:etc-chromium-browser-policies :system-files -
system-packages-doc chromium:system-packages-doc :system-packages-doc -
u2f-devices chromium:u2f-devices :u2f-devices -
unity7 chromium:unity7 :unity7 -
upower-observe chromium:upower-observe :upower-observe -
wayland chromium:wayland :wayland -
x11 chromium:x11 :x11 -

See original description
Tags: log-noise snap
Revision history for this message
Simon Déziel (sdeziel) wrote :

Here is the syscall number => name mapping on amd64:

312: sys_kcmp
314: sys_sched_setattr (so also covered in LP: #1900679)
330: pkey_alloc

tags: added: snap
description: updated
Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in chromium-browser (Ubuntu):
status: New → Confirmed
Revision history for this message
Alex Murray (alexmurray) wrote :

Limited use for sys_kcmp (aka the kcmp() system call) was added to the base template in https://github.com/snapcore/snapd/pull/12673 - this should be available in snapd >= 2.60 if you want to try testing that snapd version with chromium

The sched_setattr() is a known limitation of the current snapd seccomp sandbox where a snap can set the scheduling policy for a given thread *by that same thread* only - so if some coordinator thread wants to set the policy for a child thread that will be denied unfortunately. But this is usually just noise and does not impact the application in general.

Currently no snapd interface nor the base template itself provides access to the pkey system calls so this is a missing feature of snapd.

Nathan Teodosio (nteodosio)
Changed in chromium-browser (Ubuntu):
importance: Undecided → Low
tags: added: log-noise
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.