Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 560276 - =dev-lisp/sbcl-1.2.15 violates the sandbox by running rmdir(/)
Summary: =dev-lisp/sbcl-1.2.15 violates the sandbox by running rmdir(/)
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: [OLD] Unspecified (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Panagiotis Christopoulos (RETIRED)
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-09-12 13:08 UTC by Kobboi
Modified: 2015-09-22 04:57 UTC (History)
4 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
build.log.gz (build.log.gz,279.63 KB, application/gzip)
2015-09-12 13:09 UTC, Kobboi
Details
sandbox.log (sandbox-976.log,534 bytes, text/x-log)
2015-09-12 13:10 UTC, Kobboi
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Kobboi 2015-09-12 13:08:21 UTC
(...)
+ '[' -d contrib/sb-sprof -a -f contrib/sb-sprof/Makefile -a '!' -f obj/asdf-cache/sb-sprof/test-passed.test-report ']'
+ for dir in '`cd contrib ; echo *`'
+ '[' -d contrib/stale-symbols.lisp -a -f contrib/stale-symbols.lisp/Makefile -a '!' -f obj/asdf-cache/stale-symbols.lisp/test-passed.test-report ']'
+ for dir in '`cd contrib ; echo *`'
+ '[' -d contrib/vanilla-module.mk -a -f contrib/vanilla-module.mk/Makefile -a '!' -f obj/asdf-cache/vanilla-module.mk/test-passed.test-report ']'
+ '[' false = true ']'

The build seems to have finished successfully, including 18 (out of 18)
contributed modules. If you would like to run more extensive tests on
the new SBCL, you can try:

  cd tests && sh ./run-tests.sh

  (All tests should pass on x86/Linux, x86/FreeBSD4, and ppc/Darwin. On
  other platforms some failures are currently expected; patches welcome
  as always.)

To build documentation:

  cd doc/manual && make

To install SBCL (more information in INSTALL):

  sh install.sh


//build started:  Sat Sep 12 14:56:10 CEST 2015
//build finished: Sat Sep 12 15:00:19 CEST 2015
>>> Source compiled.
 * --------------------------- ACCESS VIOLATION SUMMARY ---------------------------
 * LOG FILE: "/var/log/sandbox/sandbox-976.log"
 * 
VERSION 1.0
FORMAT: F - Function called
FORMAT: S - Access Status
FORMAT: P - Path as passed to function
FORMAT: A - Absolute Path (not canonical)
FORMAT: R - Canonical Path
FORMAT: C - Command Line

F: rmdir
S: deny
P: /
A: /
R: /
C: /var/tmp/portage/dev-lisp/sbcl-1.2.15/work/sbcl-1.2.15/src/runtime/sbcl --noinform --core /var/tmp/portage/dev-lisp/sbcl-1.2.15/work/sbcl-1.2.15/output/sbcl.core --lose-on-corruption --disable-debugger --no-sysinit --no-userinit --load ../asdf-stub.lisp --eval (asdf::test-asdf-contrib "sb-posix") 
 * --------------------------------------------------------------------------------


Reproducible: Always
Comment 1 Kobboi 2015-09-12 13:09:32 UTC
Created attachment 411712 [details]
build.log.gz
Comment 2 Kobboi 2015-09-12 13:10:21 UTC
Created attachment 411714 [details]
sandbox.log
Comment 3 Andrey Grozin gentoo-dev 2015-09-17 03:35:27 UTC
Cannot reproduce
Comment 4 Arseny Solokha 2015-09-17 03:41:49 UTC
(In reply to Andrey Grozin from comment #3)
> Cannot reproduce

I have sandbox 2.7 installed on ~amd64.
Comment 5 Artemii 2015-09-19 19:17:13 UTC
I have same problem

Portage 2.2.20.1 (python 3.4.3-final-0, default/linux/amd64/13.0/desktop/kde, gcc-4.9.3, glibc-2.21-r1, 4.2.0-gentoo-r1 x86_64)
=================================================================
System uname: Linux-4.2.0-gentoo-r1-x86_64-AMD_FX-tm-8120_Eight-Core_Processor-with-gentoo-2.2
KiB Mem:    16475476 total,  11469604 free
KiB Swap:     525308 total,    525308 free
Timestamp of repository gentoo: Sat, 19 Sep 2015 18:30:01 +0000
sh bash 4.3_p42
ld GNU ld (Gentoo 2.25.1 p1.1) 2.25.1
app-shells/bash:          4.3_p42::gentoo
dev-java/java-config:     2.2.0::gentoo
dev-lang/perl:            5.22.0::gentoo
dev-lang/python:          2.7.10::gentoo, 3.4.3::gentoo
dev-util/cmake:           3.3.2::gentoo
dev-util/pkgconfig:       0.28-r3::gentoo
sys-apps/baselayout:      2.2::gentoo
sys-apps/openrc:          0.17::gentoo
sys-apps/sandbox:         2.7::gentoo
sys-devel/autoconf:       2.13::gentoo, 2.69-r1::gentoo
sys-devel/automake:       1.11.6-r1::gentoo, 1.13.4::gentoo, 1.14.1::gentoo, 1.15::gentoo
sys-devel/binutils:       2.25.1-r1::gentoo
sys-devel/gcc:            4.9.3::gentoo
sys-devel/gcc-config:     1.8::gentoo
sys-devel/libtool:        2.4.6-r1::gentoo
sys-devel/make:           4.1-r1::gentoo
sys-kernel/linux-headers: 4.2::gentoo (virtual/os-headers)
sys-libs/glibc:           2.21-r1::gentoo
Repositories:

gentoo
    location: /usr/portage
    sync-type: rsync
    sync-uri: rsync://rsync.gentoo.org/gentoo-portage
    priority: -1000

local
    location: /usr/local/portage
    masters: gentoo
    priority: 0

gamerlay
    location: /usr/local/portage/layman/gamerlay
    masters: gentoo
    priority: 50

java
    location: /usr/local/portage/layman/java
    masters: gentoo
    priority: 50

science
    location: /usr/local/portage/layman/science
    masters: gentoo
    priority: 50

x11
    location: /usr/local/portage/layman/x11
    masters: gentoo
    priority: 50

ACCEPT_KEYWORDS="amd64 ~amd64"
ACCEPT_LICENSE="* -@EULA PUEL dlj-1.1 Oracle-BCLA-JavaSE Intel-SDP"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-O2 -pipe -march=native -mtune=native -mfpmath=sse -msseregparm -ftree-vectorize -fomit-frame-pointer"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/lib64/libreoffice/program/sofficerc /usr/share/config /usr/share/gnupg/qualified.txt"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c"
CXXFLAGS="-O2 -pipe -march=native -mtune=native -mfpmath=sse -msseregparm -ftree-vectorize -fomit-frame-pointer"
DISTDIR="/distfiles"
EMERGE_DEFAULT_OPTS="--quiet-build=n"
FCFLAGS="-O2 -pipe"
FEATURES="assume-digests binpkg-logs config-protect-if-modified distlocks ebuild-locks fixlafiles merge-sync news parallel-fetch preserve-libs protect-owned sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userpriv usersandbox usersync xattr"
FFLAGS="-O2 -pipe"
GENTOO_MIRRORS="http://mirror.yandex.ru/gentoo-distfiles http://distfiles.gentoo.org"
LANG="ru_RU.UTF-8"
LC_ALL=""
LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,-O2 -Wl,--hash-style=gnu -Wl,--enable-new-dtags -Wl,--sort-common -Wl,-z,now"
MAKEOPTS="-j9"
PKGDIR="/usr/portage/packages"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
USE="X a52 aac acl acpi alsa amd64 apache2 avahi avx berkdb bitmap-fonts bluetooth bluray boost branding browserplugin bzip2 c++0x cairo cdda cdr cli consolekit cracklib crypt cups cxx dbus declarative dirac djvu dri dts dvb dvd dvdr egl emboss encode exif fam ffmpeg fftw firefox flac fortran freetype freetype2 gdbm gfortran gif glamor gnutls gphoto2 gpm gtk iconv idn ieee1394 ipv6 jack java jpeg jpeg2k kde kipi ladspa latex lcms ldap libnotify lm_sensors logrotate lzma mad midi mmap mmx mmxext mng modules mozilla mp3 mp4 mpeg multilib ncurses nls nptl nptlonly nsplugin ogg openal openexr opengl openmp pam pango pcre pdf phonon pic plasma png policykit postgres postresql ppds python python3 qt qt3support qt4 qt5 readline sdl seccomp semantic-desktop session shroedinger slang speex spell sqlite3 sse sse2 ssl startup-notification svg tcpd theora thread threads tiff truetype truetype-fonts type1-fonts udev udisks unicode upower usb utf8 v4l vaapi vorbis vpx wxwidgets x264 xattr xcb xcomposite xinerama xml xrandr xscreensaver xv xvid xvmc xz zlib" ABI_X86="64 32" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="kexi words flow plan sheets stage tables krita karbon braindump author" CAMERAS="canon fuji template ptp2 directory" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="aes avx fma4 mmx mmxext popcnt sse sse2 sse3 sse4_1 sse4_2 sse4a ssse3 xop" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ublox ubx" GRUB_PLATFORMS="efi-64 coreboot" INPUT_DEVICES="evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LINGUAS="ru en" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php5-5" PYTHON_SINGLE_TARGET="python2_7" PYTHON_TARGETS="python2_7 python3_4" RUBY_TARGETS="ruby21 ruby22" USERLAND="GNU" VIDEO_CARDS="vesa radeonsi radeon amdgpu" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account"
USE_PYTHON="2.7 3.4"
Unset:  CC, CPPFLAGS, CTARGET, CXX, INSTALL_MASK, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS
Comment 6 Arseny Solokha 2015-09-21 03:59:59 UTC
Also reproducible w/ sandbox 2.8.
Comment 7 Andrey Grozin gentoo-dev 2015-09-21 10:10:55 UTC
Interesting. I tested sbcl-1.2.15 on ~amd64 and ~x86 with sandbox-2.7, everything was OK (and I successfully used this sbcl to compile maxima and fricas). Now I've upgraged sandbox to 2.8, and see the same failure both on ~amd64 and ~x86. However, in the log file of sandbox-2.8 I see

In file included from /usr/include/features.h:390:0,
                 from /usr/include/dirent.h:25,
                 from /var/tmp/portage/sys-apps/sandbox-2.8/work/sandbox-2.8/headers.h:15,
                 from <command-line>:0:
/usr/include/gnu/stubs.h:13:28: fatal error: gnu/stubs-x32.h: No such file or directory
 # include <gnu/stubs-x32.h>
                            ^
compilation terminated.

and also some warnings like

*** Warning: Linking the shared library libsandbox.la against the
*** static library ../libsbutil/.libs/libsbutil.a is not portable!

and (at install phase)

libtool: warning: remember to run 'libtool --finish /usr/lib32'

Nevertheless, emerging sandbox-2.8 seemingly completes successfully. I wonder if the resulting sandbox-2.8 is broken. Surely, sbcl does not try to rmdir /. And I still have perfectly working sbcl-1.2.12 on both ~amd64 and ~x86 boxes. I suspect something must be wrong with sandbox-2.8.
Comment 8 Andrey Grozin gentoo-dev 2015-09-21 10:13:04 UTC
> And I still have perfectly working sbcl-1.2.12 on both ~amd64 and
                                           1.2.15   sorry
> ~x86 boxes. I suspect something must be wrong with sandbox-2.8.
Comment 9 Arseny Solokha 2015-09-21 10:14:28 UTC
(In reply to Andrey Grozin from comment #7)
> However, in the log file of sandbox-2.8 I see
> 
> In file included from /usr/include/features.h:390:0,
>                  from /usr/include/dirent.h:25,
>                  from
> /var/tmp/portage/sys-apps/sandbox-2.8/work/sandbox-2.8/headers.h:15,
>                  from <command-line>:0:
> /usr/include/gnu/stubs.h:13:28: fatal error: gnu/stubs-x32.h: No such file
> or directory
>  # include <gnu/stubs-x32.h>
>                             ^
> compilation terminated.
> 
> and also some warnings like
> 
> *** Warning: Linking the shared library libsandbox.la against the
> *** static library ../libsbutil/.libs/libsbutil.a is not portable!
> 
> and (at install phase)
> 
> libtool: warning: remember to run 'libtool --finish /usr/lib32'

You are not doing LTO build, are you?
Comment 10 Kobboi 2015-09-21 10:40:11 UTC
I can still reproduce on at least two of my machines.
Comment 11 Andrey Grozin gentoo-dev 2015-09-21 13:07:35 UTC
On both ~amd64 and ~x86 boxes, sbcl-1.2.15 successfully builds and installs with sandbox-2.6-r1. With sandbox-2.7 and 2.8 attempting to emerge sbcl lead to sandbox violation.
Comment 12 Kobboi 2015-09-21 13:35:53 UTC
I confirm: 5 compilations failing on sandbox-2.7 and sandbox-2.8, 5 compilations successful on sandbox-2.6-r1
Comment 13 SpanKY gentoo-dev 2015-09-21 17:14:48 UTC
(In reply to Andrey Grozin from comment #7)

the sandbox build output is fine
Comment 14 SpanKY gentoo-dev 2015-09-21 20:57:15 UTC
not a bug in the sandbox ... it's working correctly.  sbcl tries to run rmdir(/) which is wrong, and the sandbox is correct in catching & throwing a violation.

the fact sandbox-2.6 didn't catch it is most likely due to some of the env reset logic the ebuild employees ... older sandbox-2.6 would have been disabled in that case, while newer ones will save & restore itself on the fly.
Comment 15 SpanKY gentoo-dev 2015-09-21 20:57:58 UTC
(In reply to SpanKY from comment #14)

specifically look at contrib/sb-posix/posix-tests.lisp which does:
(deftest rmdir.error.3
  (handler-case 
      (sb-posix:rmdir #-win32 "/" #+win32 (sb-ext:posix-getenv "windir"))
...
Comment 16 Andrey Grozin gentoo-dev 2015-09-22 04:57:14 UTC
(In reply to SpanKY from comment #15)
> (deftest rmdir.error.3
>   (handler-case 
>       (sb-posix:rmdir #-win32 "/" #+win32 (sb-ext:posix-getenv "windir"))
Thanks. So, it expects ebusy, but produces a sandbox violation instead.

OK. Commenting out this test:


commit e53567187f146ee1f52d537d6f2efacb6a91f4c1
Author: Andrey Grozin <grozin@gentoo.org>
Date:   Tue Sep 22 10:50:18 2015 +0600

    dev-lisp/sbcl: comment out a test in posix-tests.lisp
    
    Bugs: 560276, 561018