[From nobody Wed Sep 16 16:49:05 2026 Received: (at submit) by bugs.debian.org; 1 Mar 2026 22:18:08 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-126.1 required=4.0 tests=BAYES_00, BODY_INCLUDES_CONTROL_AFFECTS,BODY_INCLUDES_PACKAGE,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA, FROMDEVELOPER,HAS_PACKAGE,SPF_HELO_NONE,SPF_NONE,UNPARSEABLE_RELAY, USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 19; hammy, 150; neutral, 171; spammy, 0. spammytokens: hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin, 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311, 0.000-+--H*RT:311, 0.000-+--H*RT:108 Return-path: <smcv@debian.org> Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:46582) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <smcv@debian.org>) id 1vwp72-00F6Ut-0n for submit@bugs.debian.org; Sun, 01 Mar 2026 22:18:08 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Content-Type:MIME-Version:Message-ID: Subject:To:From:Date:Reply-To:Cc:Content-Transfer-Encoding:Content-ID: Content-Description:In-Reply-To:References; bh=N7yqDG8ykFm1BdncSo+Yk5+X3m5HUbPzWCTBsdydaRk=; b=XawguSnR9tBhUWYy/PhyLQ4g4G DgiLmMJ6LhxO1+sskSm+fEqsaGzaxsheqWuwj0K0r+4PcAv1O3JAzayyZK+ZoNzcKV6yhSZ7+WU9B jiAtrCTAbQkNRa1V3MMBIQ3LRUM96WeIXJeFv7pRnNvRMY4pieHcm1pICkohxHJtuuQ0c3nTlrpEb s1Z5QvVzFp7q4HiES9ODQAZC7j05SFRY1DJmJtKqI9v5qw0VTWunGqO999knkHLPm3jWI4oQyOUIb fJzfKRW2P41UAD9DUlY6dXamcIKQ7BGUhiCL4JLOcayxTgKBy+JLTkoZEukju6b3h4mF4roxi3t3d gAoo0A0Q==; Received: from authenticated user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.94.2) (envelope-from <smcv@debian.org>) id 1vwp6z-00DwyK-C8 for submit@bugs.debian.org; Sun, 01 Mar 2026 22:18:06 +0000 Date: Sun, 1 Mar 2026 22:18:02 +0000 From: Simon McVittie <smcv@debian.org> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: glycin: i386 processes on amd64, e.g. Steam, result in bwrap crash with SIGSYS and non-sandboxed loaders Message-ID: <aaS7GkOraTlzlb5t@remnant.pseudorandom.co.uk> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Mutt-Fcc: =.lists.debian/ X-Reportbug-Version: 13.2.0 X-Debian-User: smcv Delivered-To: submit@bugs.debian.org Package: libglycin-2-0 Version: 2.0.8-1 Severity: important Tags: forky sid upstream Forwarded: https://gitlab.gnome.org/GNOME/glycin/-/issues/269 Control: affects -1 + steam-installer libgdk-pixbuf-2.0-0 bubblewrap X-Debbugs-Cc: gdk-pixbuf@packages.debian.org Original steps to reproduce --------------------------- * GNOME desktop environment (possibly others, I've only tested GNOME) * Run Steam, which is a 32-bit (i386) executable that uses gdk-pixbuf via GTK; on recent distros, gdk-pixbuf in turn uses glycin * Lock the screen, which for whatever reason results in Steam's main process invoking gdk-pixbuf and therefore glycin Simplified steps to reproduce ----------------------------- * Have an amd64 system with i386 foreign architecture, libgdk-pixbuf-2.0-dev:i386 installed, bubblewrap:amd64 installed * Compile the simple gdk-pixbuf program below as an i386 executable * e.g. i686-linux-gnu-gcc -ot t.c $(i686-linux-gnu-pkgconf --cflags --libs gdk-pixbuf-2.0) * Run `./t` ----8<---- #include <gdk-pixbuf/gdk-pixbuf.h> int main (void) { GError *error = NULL; GdkPixbuf *px = gdk_pixbuf_new_from_file ("/usr/share/pixmaps/debian-logo.png", &error); g_assert_no_error (error); return (px != NULL) ? 0 : 1; } ----8<---- Expected result --------------- The host program (Steam or my simplified test program) successfully runs Glycin loaders in a bubblewrap sandbox. Actual result ------------- bubblewrap is terminated by `SIGSYS` when glycin runs `true` to probe whether sandboxing is possible, resulting in a crash / core dump. The systemd Journal reports something like this: kernel: audit: type=1326 audit(1772398687.390:171): auid=1000 uid=1000 gid=1000 ses=2 subj=unconfined pid=165156 comm="bwrap" exe="/usr/bin/bwrap" sig=31 arch=c000003e syscall=59 compat=0 ip=0x7f50bbec3097 code=0x0 kernel: audit: type=1326 audit(1772398687.390:172): auid=1000 uid=1000 gid=1000 ses=2 subj=unconfined pid=165155 comm="bwrap" exe="/usr/bin/bwrap" sig=31 arch=c000003e syscall=61 compat=0 ip=0x7f50bbe73e92 code=0x0 As a result glycin falls back to running the loaders un-sandboxed. Workarounds ----------- Someone who knows enough Rust (sorry, that's not me) could patch glycin so that when compiled for i386, it applies a seccomp filter that allows both i386 and x86_64 syscalls. That wouldn't fully solve the problem, but would deal with the most common case. Failing that, we could avoid the SIGSYS and core dump by disabling glycin in i386 builds of gdk-pixbuf. Again, that wouldn't fully solve the problem but would deal with the most common case. I think a full solution would require structural changes upstream. See the upstream bug report for details. ]