* ----------------------- SANDBOX ACCESS VIOLATION SUMMARY ----------------------- * LOG FILE: "/var/tmp/portage/www-client/firefox-115.13.0/temp/sandbox.log" * VERSION 1.0 FORMAT: F - Function called FORMAT: S - Access Status FORMAT: P - Path as passed to function FORMAT: A - Absolute Path (not canonical) FORMAT: R - Canonical Path FORMAT: C - Command Line F: open_wr S: deny P: /dev/udmabuf A: /dev/udmabuf R: /dev/udmabuf C: Xvfb -displayfd 1 -screen 0 1280x1024x24 +extension RANDR F: open_wr S: deny P: /dev/udmabuf A: /dev/udmabuf R: /dev/udmabuf C: /var/tmp/portage/www-client/firefox-115.13.0/work/firefox_build/instrumented/dist/firefox/firefox data:text/html,<script>Quitter.quit()</script> -profile /var/tmp/portage/www-client/firefox-115.13.0/temp/tmptz0m5a2q F: open_wr S: deny P: /dev/udmabuf A: /dev/udmabuf R: /dev/udmabuf C: /var/tmp/portage/www-client/firefox-115.13.0/work/firefox_build/instrumented/dist/firefox/firefox http://localhost:8888/index.html -profile /var/tmp/portage/www-client/firefox-115.13.0/temp/tmptz0m5a2q Reproducible: Always emerge --info www-client/firefox Portage 3.0.65 (python 3.12.3-final-0, server, gcc-13, glibc-2.39-r6, 6.6.35-gentoo-dist-hardened x86_64) ================================================================= System Settings ================================================================= System uname: Linux-6.6.35-gentoo-dist-hardened-x86_64-AMD_Ryzen_9_7950X_16-Core_Processor-with-glibc2.39 KiB Mem: 131061136 total, 39917172 free KiB Swap: 0 total, 0 free Timestamp of repository gentoo: Fri, 19 Jul 2024 06:07:02 +0000 Head commit of repository gentoo: 333160ad5bc48710f28dd9f5de9d2f274d0bf08e Head commit of repository jonesmz-public-overlay: 066d1e1e163c084a3adcf356497258bc6f02e9f7 Head commit of repository lto-overlay: a46a5749ee6e70bcf2317f9d6e24037779b643a8 Head commit of repository mv: 8ef8abbbe4f281a9527f8cb5382808a0b2234699 Head commit of repository wsdd: 9c546e56ca51a7f6575e04f5fd9a2ca33758f9f4 sh bash 5.2_p26-r6 ld GNU ld (Gentoo 2.42 p3) 2.42.0 ccache version 4.9.1 [disabled] app-misc/pax-utils: 1.3.7::gentoo app-shells/bash: 5.2_p26-r6::gentoo dev-build/autoconf: 2.13-r8::gentoo, 2.71-r7::gentoo dev-build/automake: 1.16.5-r2::gentoo dev-build/cmake: 3.28.5::gentoo dev-build/libtool: 2.4.7-r4::gentoo dev-build/make: 4.4.1-r1::gentoo dev-build/meson: 1.4.1::gentoo dev-lang/perl: 5.38.2-r3::gentoo dev-lang/python: 3.11.9-r1::gentoo, 3.12.3-r1::gentoo dev-lang/rust: 1.77.1::gentoo dev-util/ccache: 4.9.1-r1::gentoo sys-apps/baselayout: 2.15::gentoo sys-apps/sandbox: 2.38::gentoo sys-apps/systemd: 255.7-r1::gentoo sys-devel/binutils: 2.42-r1::gentoo sys-devel/binutils-config: 5.5::gentoo sys-devel/clang: 17.0.6::gentoo sys-devel/gcc: 13.3.1_p20240614::gentoo sys-devel/gcc-config: 2.11::gentoo sys-devel/lld: 17.0.6::gentoo sys-devel/llvm: 17.0.6::gentoo sys-kernel/linux-headers: 6.6-r1::gentoo (virtual/os-headers) sys-libs/glibc: 2.39-r6::gentoo Repositories: gentoo location: /var/db/repos/gentoo sync-type: git sync-uri: git://anongit.gentoo.org/repo/sync/gentoo.git priority: -1000 volatile: False jonesmz-public-overlay location: /var/db/repos/jonesmz-public-overlay sync-type: git sync-uri: https://github.com/jonesmz/gentoo-overlay.git masters: gentoo volatile: False lto-overlay location: /var/db/repos/lto-overlay sync-type: git sync-uri: https://github.com/InBetweenNames/gentooLTO.git masters: gentoo mv volatile: False mv location: /var/db/repos/mv sync-type: git sync-uri: https://anongit.gentoo.org/git/user/mv.git masters: gentoo volatile: False wsdd location: /var/db/repos/wsdd-gentoo sync-type: git sync-uri: https://github.com/christgau/wsdd-gentoo masters: gentoo volatile: False Installed sets: @archive, @desktop-applications, @lxqt, @pc-base-system, @portage ACCEPT_KEYWORDS="amd64" ACCEPT_LICENSE="@FREE" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-O3 -fgraphite-identity -floop-nest-optimize -fdevirtualize-at-ltrans -fipa-pta -fno-semantic-interposition -flto=auto -fuse-linker-plugin -march=core2 -mtune=generic -mpopcnt" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/config /usr/share/gnupg/qualified.txt" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c" CXXFLAGS="-O3 -fgraphite-identity -floop-nest-optimize -fdevirtualize-at-ltrans -fipa-pta -fno-semantic-interposition -flto=auto -fuse-linker-plugin -march=core2 -mtune=generic -mpopcnt -O2 -pipe" DISTDIR="/var/cache/distfiles" EMERGE_DEFAULT_OPTS=" --jobs --keep-going --newrepo --newuse --changed-use --changed-deps --changed-slot --deep --tree --unordered-display --backtrack=3000 --complete-graph --with-bdeps=y --rebuild-if-new-rev --rebuild-if-new-ver --rebuild-if-unbuilt --rebuilt-binaries --binpkg-respect-use=y --binpkg-changed-deps=y --usepkg=y --buildpkg-exclude='virtual/*' --buildpkg-exclude='sys-kernel/*' --buildpkg-exclude='*/*-bin' --buildpkg-exclude='acct-user/*' --buildpkg-exclude='acct-group/*' --buildpkg-exclude='app-alternatives/*' --buildpkg-exclude='dev-perl/*' --usepkg-exclude='virtual/*' --usepkg-exclude='sys-kernel/*' --usepkg-exclude='*/*-bin' --usepkg-exclude='acct-user/*' --usepkg-exclude='acct-group/*' --usepkg-exclude='app-alternatives/*' --usepkg-exclude='dev-perl/*'" ENV_UNSET="CARGO_HOME DBUS_SESSION_BUS_ADDRESS DISPLAY GDK_PIXBUF_MODULE_FILE GOBIN GOPATH PERL5LIB PERL5OPT PERLPREFIX PERL_CORE PERL_MB_OPT PERL_MM_OPT XAUTHORITY XDG_CACHE_HOME XDG_CONFIG_HOME XDG_DATA_HOME XDG_RUNTIME_DIR XDG_STATE_HOME" FCFLAGS="-O2 -pipe" FEATURES="assume-digests binpkg-docompress binpkg-dostrip binpkg-logs binpkg-multi-instance buildpkg buildpkg-live clean-logs compress-build-logs compressdebug config-protect-if-modified distlocks ebuild-locks fixlafiles installsources ipc-sandbox merge-sync merge-wait multilib-strict network-sandbox news parallel-fetch parallel-install pid-sandbox pkgdir-index-trusted preserve-libs protect-owned qa-unresolved-soname-deps sandbox sfperms split-elog split-log splitdebug strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr" FFLAGS="-O2 -pipe" GENTOO_MIRRORS="http://distfiles.gentoo.org" INSTALL_MASK="/etc/init.d/* /etc/cron.*/* /usr/share/doc/*/Changelog* /usr/share/doc/*/*/Changelog* /usr/share/doc/*/AUTHORS* /usr/share/doc/*/*/AUTHORS*" LANG="en_US.utf8" LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,-z,pack-relative-relocs" LEX="flex" LINGUAS="en en_US" PKGDIR="/var/cache/binpkgs" PORTAGE_COMPRESS="zstd" PORTAGE_COMPRESS_FLAGS="-15" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git" PORTAGE_TMPDIR="/var/tmp" SHELL="/bin/bash" USE="X a52 aac acl acpi alsa amd64 branding bzip2 cairo cdda cdr cet crypt dbus dri dts dvd dvdr encode exif flac gdbm gif gnome-keyring gpm gstreamer gtk gui hardened iconv icu ipv6 jpeg kf6compat lcms libnotify libtirpc mad mng mp3 mp4 mpeg multilib ncurses nls ogg opengl openmp pam pango pcre pdf pic pie png policykit ppds pulseaudio qt5 readline sdl seccomp sound spell ssl ssp startup-notification svg systemd test-rust tiff truetype udev udisks unicode upower usb vaapi vorbis vulkan wxwidgets x264 xattr xcb xft xml xtpax xv xvid zlib" ABI_X86="64" ADA_TARGET="gcc_12" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_anon authn_dbm authn_file authz_dbm authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir env expires ext_filter file_cache filter headers include info log_config logio mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="karbon sheets words" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="mmx mmxext sse sse2 mmxext sse sse3 lm cmov cx8 fpu fxsr mmx syscall sse2 cx16 lahf_lm popcnt ssse3" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock greis isync itrax mtk3301 ntrip navcom oceanserver oncore rtcm104v2 rtcm104v3 sirf skytraq superstar2 tsip tripmate tnt ublox" INPUT_DEVICES="libinput" KERNEL="linux" L10N="en en-US" LCD_DEVICES="bayrad cfontz glk hd44780 lb216 lcdm001 mtxorb text" LLVM_TARGETS="AArch64 AMDGPU BPF WebAssembly X86" LUA_SINGLE_TARGET="lua5-1" LUA_TARGETS="lua5-1" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php8-2" POSTGRES_TARGETS="postgres15" PYTHON_SINGLE_TARGET="python3_12" PYTHON_TARGETS="python3_12" QEMU_SOFTMMU_TARGETS="aarch64 x86_64" QEMU_USER_TARGETS="aarch64 x86_64" RUBY_TARGETS="ruby31 ruby32" VIDEO_CARDS="vesa modesetting radeon radeonsi amdgpu" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipp2p iface geoip fuzzy condition tarpit sysrq proto logmark ipmark dhcpmac delude chaos account" Unset: ADDR2LINE, AR, ARFLAGS, AS, ASFLAGS, CC, CCLD, CONFIG_SHELL, CPP, CPPFLAGS, CTARGET, CXX, CXXFILT, ELFEDIT, EXTRA_ECONF, F77FLAGS, FC, GCOV, GPROF, LC_ALL, LD, LFLAGS, LIBTOOL, MAKE, MAKEFLAGS, MAKEOPTS, NM, OBJCOPY, OBJDUMP, PORTAGE_BINHOST, PORTAGE_BUNZIP2_COMMAND, PORTAGE_RSYNC_EXTRA_OPTS, PYTHONPATH, RANLIB, READELF, RUSTFLAGS, SIZE, STRINGS, STRIP, YACC, YFLAGS ================================================================= Package Settings ================================================================= www-client/firefox-115.13.0::gentoo was built with the following: USE="X hardened hwaccel lto openh264 pgo pulseaudio system-av1 system-harfbuzz system-icu system-jpeg system-libevent system-libvpx system-png system-webp -clang -dbus -debug -eme-free -geckodriver (-gmp-autoupdate) -jack -libproxy -screencast (-selinux) -sndio (-system-python-libs) -wayland -wifi" ABI_X86="(64)" L10N="-ach -af -an -ar -ast -az -be -bg -bn -br -bs -ca -ca-valencia -cak -cs -cy -da -de -dsb -el -en-CA -en-GB -eo -es-AR -es-CL -es-ES -es-MX -et -eu -fa -ff -fi -fr -fur -fy -ga -gd -gl -gn -gu -he -hi -hr -hsb -hu -hy -ia -id -is -it -ja -ka -kab -kk -km -kn -ko -lij -lt -lv -mk -mr -ms -my -nb -ne -nl -nn -oc -pa -pl -pt-BR -pt-PT -rm -ro -ru -sc -sco -si -sk -sl -son -sq -sr -sv -szl -ta -te -th -tl -tr -trs -uk -ur -uz -vi -xh -zh-CN -zh-TW" CFLAGS="-fgraphite-identity -floop-nest-optimize -fdevirtualize-at-ltrans -fno-semantic-interposition -fuse-linker-plugin -march=core2 -mtune=generic -mpopcnt -Wl,-O1 -Wl,--as-needed -Wl,-z,pack-relative-relocs" CXXFLAGS="-fgraphite-identity -floop-nest-optimize -fdevirtualize-at-ltrans -fno-semantic-interposition -fuse-linker-plugin -march=core2 -mtune=generic -mpopcnt -pipe -Wl,-O1 -Wl,--as-needed -Wl,-z,pack-relative-relocs" LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,-z,pack-relative-relocs -fgraphite-identity -floop-nest-optimize -fdevirtualize-at-ltrans -fno-semantic-interposition -fuse-linker-plugin -march=core2 -mtune=generic -mpopcnt -pipe -Wl,-z,relro -Wl,-z,now -z,pack-relative-relocs -Wl,--compress-debug-sections=zlib -Wl,-rpath=/usr/lib64/firefox,--enable-new-dtags"
the build log, even when compressed with `xz -9` is larger than the 1000kb limit. I think it's time for bugzilla to have a larger filesize limit...
Created attachment 897958 [details] Last quarter of build log Uploaded last quarter of build log using ``` zcat firefox-115.13.0\:20240719-034926.log.gz | split -n l/4/4 - | xz -9 > firefox-115.13.0:20240719-034926.log.xz ```
Can confirm this issue. Having the same problem.
Our Firefox "rapid" is way more open with sandbox restrictions compared to esr. Rapid: https://gitweb.gentoo.org/repo/gentoo.git/tree/www-client/firefox/firefox-128.0.ebuild#n543 ESR: https://gitweb.gentoo.org/repo/gentoo.git/tree/www-client/firefox/firefox-115.13.0.ebuild#n584 Basically you'll want to add: addpredict /dev or addpredict /dev/udmabuf to the ebuild under this "if use pgo ; then" block. I don't think this will be fixed for 115esr as 128.1.0 esr ebuilds will be out in a couple of weeks, and those are going to carry the more lenient sandbox accesses.
There was something similar for libreoffice. See Bug 933257
(In reply to Joonas Niilola from comment #4) > Our Firefox "rapid" is way more open with sandbox restrictions compared to > esr. > > Rapid: > https://gitweb.gentoo.org/repo/gentoo.git/tree/www-client/firefox/firefox- > 128.0.ebuild#n543 > ESR: > https://gitweb.gentoo.org/repo/gentoo.git/tree/www-client/firefox/firefox- > 115.13.0.ebuild#n584 > > Basically you'll want to add: > addpredict /dev > > or > addpredict /dev/udmabuf > > to the ebuild under this "if use pgo ; then" block. I don't think this will > be fixed for 115esr as 128.1.0 esr ebuilds will be out in a couple of weeks, > and those are going to carry the more lenient sandbox accesses. Thanks, I was able to build firefox-115.13.0:esr with pgo after adding addpredict /dev/udmabuf to the ebuild: if use pgo ; then # Update 105.0: "/proc/self/oom_score_adj" isn't enough anymore with pgo, but not sure # whether that's due to better OOM handling by Firefox (bmo#1771712), or portage # (PORTAGE_SCHEDULING_POLICY) update... addpredict /proc # May need a wider addpredict when using wayland+pgo. addpredict /dev/dri addpredict /dev/udmabuf # emerge -vp firefox These are the packages that would be merged, in order: Calculating dependencies... done! Dependency resolution took 8.69 s (backtrack: 1/20). [ebuild R ] www-client/firefox-115.13.0:esr::gentoo USE="X clang dbus geckodriver gmp-autoupdate hwaccel lto openh264 pgo pulseaudio screencast system-av1 system-harfbuzz system-icu system-jpeg system-libevent system-libvpx system-png system-webp wayland wifi -debug -eme-free -hardened -jack -libproxy (-selinux) -sndio (-system-python-libs)" L10N="-ach -af -an -ar -ast -az -be -bg -bn -br -bs -ca -ca-valencia -cak -cs -cy -da -de -dsb -el -en-CA -en-GB -eo -es-AR -es-CL -es-ES -es-MX -et -eu -fa -ff -fi -fr -fur -fy -ga -gd -gl -gn -gu -he -hi -hr -hsb -hu -hy -ia -id -is -it -ja -ka -kab -kk -km -kn -ko -lij -lt -lv -mk -mr -ms -my -nb -ne -nl -nn -oc -pa -pl -pt-BR -pt-PT -rm -ro -ru -sc -sco -si -sk -sl -son -sq -sr -sv -szl -ta -te -th -tl -tr -trs -uk -ur -uz -vi -xh -zh-CN -zh-TW" 0 KiB Total: 1 package (1 reinstall), Size of downloads: 0 KiB #
Looks like this issue fixed in ebuild firefox-128.0.3.ebuild in line 548: 541 if use pgo ; then 542 # Update 105.0: "/proc/self/oom_score_adj" isn't enough anymore with pgo, but not sure 543 # whether that's due to better OOM handling by Firefox (bmo#1771712), or portage 544 # (PORTAGE_SCHEDULING_POLICY) update... 545 addpredict /proc 546 547 # Clear tons of conditions, since PGO is hardware-dependant. 548 addpredict /dev 549 fi Maybe, it has sense to backport this fix to www-client/firefox-115.13.0:esr::gentoo
(In reply to Maksym Sditanov from comment #7) > Maybe, it has sense to backport this fix to > www-client/firefox-115.13.0:esr::gentoo If you make a PR updating that in 115.14.0 before it's stabilized, I'll merge it. Otherwise I'm too lazy to touch 115esr anymore, since 128.1.0esr is in the tree already and 115esr will be cleaned ~soon altogether. It's not a huge change but it requires testing and I'd rather focus on 129+ and 128esr+. That being said, 128.1.0esr should work for everyone since it has more relaxed sandbox restrictions.
The bug has been closed via the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=48b4885e4f9a19ccc4c1489a387e38fb3b7d62b7 commit 48b4885e4f9a19ccc4c1489a387e38fb3b7d62b7 Author: Maksym Sditanov <msditanov@200volts.com> AuthorDate: 2024-08-06 20:20:21 +0000 Commit: Joonas Niilola <juippis@gentoo.org> CommitDate: 2024-08-07 05:39:54 +0000 www-client/firefox: fix PGO for 115.13.0, 115.14.0 - fix PGO compilation: relax sandbox restrictions for /dev since PGO is hardware-dependant. Closes: https://bugs.gentoo.org/936278 Signed-off-by: Maksym Sditanov <msditanov@200volts.com> Closes: https://github.com/gentoo/gentoo/pull/37998 Signed-off-by: Joonas Niilola <juippis@gentoo.org> www-client/firefox/firefox-115.13.0.ebuild | 4 ++-- www-client/firefox/firefox-115.14.0.ebuild | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
