Bug#1129470: glycin: i386 processes on amd64, e.g. Steam, result in bwrap crash with SIGSYS and non-sandboxed loaders

[Simon McVittie]

Package: libglycin-2-0
Version: 2.0.8-1
Severity: important
Tags: forky sid upstream
Forwarded: https://gitlab.gnome.org/GNOME/glycin/-/issues/269
Control: affects -1 + steam-installer libgdk-pixbuf-2.0-0 bubblewrap
X-Debbugs-Cc: gdk-pixbuf at packages.debian.org

Original steps to reproduce
---------------------------

* GNOME desktop environment (possibly others, I've only tested GNOME)
* Run Steam, which is a 32-bit (i386) executable that uses gdk-pixbuf
  via GTK; on recent distros, gdk-pixbuf in turn uses glycin
* Lock the screen, which for whatever reason results in Steam's main
  process invoking gdk-pixbuf and therefore glycin

Simplified steps to reproduce
-----------------------------

* Have an amd64 system with i386 foreign architecture,
  libgdk-pixbuf-2.0-dev:i386 installed, bubblewrap:amd64 installed
* Compile the simple gdk-pixbuf program below as an i386 executable
    * e.g. i686-linux-gnu-gcc -ot t.c $(i686-linux-gnu-pkgconf --cflags --libs gdk-pixbuf-2.0)
* Run `./t`

----8<----
#include <gdk-pixbuf/gdk-pixbuf.h>

int main (void)
{
  GError *error = NULL;
  GdkPixbuf *px = gdk_pixbuf_new_from_file ("/usr/share/pixmaps/debian-logo.png", &error);
  g_assert_no_error (error);
  return (px != NULL) ? 0 : 1;
}
----8<----

Expected result
---------------

The host program (Steam or my simplified test program) successfully runs
Glycin loaders in a bubblewrap sandbox.

Actual result
-------------

bubblewrap is terminated by `SIGSYS` when glycin runs `true` to probe
whether sandboxing is possible, resulting in a crash / core dump. The
systemd Journal reports something like this:

kernel: audit: type=1326 audit(1772398687.390:171): auid=1000 uid=1000 gid=1000 ses=2 subj=unconfined pid=165156 comm="bwrap" exe="/usr/bin/bwrap" sig=31 arch=c000003e syscall=59 compat=0 ip=0x7f50bbec3097 code=0x0
kernel: audit: type=1326 audit(1772398687.390:172): auid=1000 uid=1000 gid=1000 ses=2 subj=unconfined pid=165155 comm="bwrap" exe="/usr/bin/bwrap" sig=31 arch=c000003e syscall=61 compat=0 ip=0x7f50bbe73e92 code=0x0

As a result glycin falls back to running the loaders un-sandboxed.

Workarounds
-----------

Someone who knows enough Rust (sorry, that's not me) could patch glycin 
so that when compiled for i386, it applies a seccomp filter that allows 
both i386 and x86_64 syscalls. That wouldn't fully solve the problem, 
but would deal with the most common case.

Failing that, we could avoid the SIGSYS and core dump by disabling glycin
in i386 builds of gdk-pixbuf. Again, that wouldn't fully solve the problem but 
would deal with the most common case.

I think a full solution would require structural changes upstream. See 
the upstream bug report for details.