diff options
Diffstat (limited to 'results/classifier/118/graphic/2116')
| -rw-r--r-- | results/classifier/118/graphic/2116 | 58 |
1 files changed, 58 insertions, 0 deletions
diff --git a/results/classifier/118/graphic/2116 b/results/classifier/118/graphic/2116 new file mode 100644 index 000000000..9b513f8f6 --- /dev/null +++ b/results/classifier/118/graphic/2116 @@ -0,0 +1,58 @@ +graphic: 0.990 +x86: 0.902 +user-level: 0.895 +performance: 0.875 +device: 0.861 +semantic: 0.836 +PID: 0.790 +peripherals: 0.781 +architecture: 0.744 +boot: 0.726 +debug: 0.697 +ppc: 0.658 +permissions: 0.650 +socket: 0.648 +kernel: 0.596 +network: 0.593 +files: 0.558 +vnc: 0.555 +i386: 0.543 +hypervisor: 0.511 +register: 0.483 +VMM: 0.462 +mistranslation: 0.449 +virtual: 0.446 +TCG: 0.381 +risc-v: 0.372 +arm: 0.323 +assembly: 0.235 +KVM: 0.130 + +[CRASH] OpenGL acceleration except gtk: bad interaction between NVIDIA usermode opengl libraries and QEMU seccomp -sandbox on,spawn=deny, crashes immediately on startup with Bad system call +Description of problem: +When running any of the above command lines, QEMU crashes with Bad system call (core dumped). Not exclusive to spice; it seems this is caused by QEMU forking during OpenGL initialization after seccomp takes effect. +Steps to reproduce: +1. Run the above commandline +2. Notice a Bad system call (core dumped) +Additional information: +This crash only happens if spawn=deny is set, resourcecontrol/obsolete/elevateprivileges don't cause crashes. + +The crash happens around the same time as an audit event is generated in dmesg: `audit: type=1326 audit(1705775880.776:14): auid=MYUSERID uid=MYUID gid=MYGID ses=REDACTED pid=REDACTED comm="qemu-system-x86" exe="/usr/bin/qemu-system-x86_64" sig=31 arch=c000003e syscall=56 compat=0 ip=REDACTED code=REDACTED` + +`ausyscall c000003e 56` tells me it's `clone` which (iirc) is the syscall used by glibc to implement fork() (I might be wrong about glibc part) + +Suggested solution: move seccomp activation until just before guest code starts executing? make frontends (ie -display gtk/sdl/whatever, including -spice) initialize before seccomp? + +Workaround: `chmod -x /bin/nvidia-modprobe` if not using the NVIDIA gpu or use this wrapper script (untested, not enterprise-ready, I am not responsible if unexpected things happen): +- rename /bin/qemu-system-x86_64 to qemu-system-x86_64.real +- put this in /bin/qemu-system-x86_64 and chmod +x it +```sh +#!/usr/bin/env sh +chmod -x /bin/nvidia-modprobe +qemu-system-x86_64.real $@ & disown +sleep 10 # excessive but maybe safer? +chmod +x /bin/nvidia-modprobe +``` +Also, you can use -display gtk,gl=on instead, or (unknown security implications) remove spawn=deny from -sandbox args + +original bug report was https://gitlab.com/libvirt/libvirt/-/issues/585 but I realized this was more of a qemu issue than a libvirt one |