syscall: Faccessat crashes because faccessat2 is blocked on Android

[zorro]

What version of Go are you using (go version)?

$ go version
go version go1.20rc1 linux/amd64

Does this issue reproduce with the latest release?

no

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/arunz/.cache/go-build"
GOENV="/home/arunz/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/home/arunz/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home/arunz/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/home/arunz/.local/lib/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/home/arunz/.local/lib/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.20rc1"
GCCGO="gccgo"
GOAMD64="v1"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/dev/null"
GOWORK=""
CGO_CFLAGS="-O2 -g"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-O2 -g"
CGO_FFLAGS="-O2 -g"
CGO_LDFLAGS="-O2 -g"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build994068824=/tmp/go-build -gno-record-gcc-switches"
uname -sr: Linux 4.19.0-22-amd64
Distributor ID:	Debian
Description:	Debian GNU/Linux 10 (buster)
Release:	10
Codename:	buster
/lib/x86_64-linux-gnu/libc.so.6: GNU C Library (Debian GLIBC 2.28-10+deb10u2) stable release version 2.28.
gdb --version: GNU gdb (Debian 8.2.1-2+b3) 8.2.1

What did you do?

The following program crashes on Android because faccessat2(2) is blocked on Android

package main

import (                                                
	"fmt"
        "golang.org/x/sys/unix"
        "syscall"
)

func main() {
        path := "/"
        err := syscall.Faccessat(0, path, unix.R_OK, unix.AT_EACCESS)
        fmt.Printf("uid %v, euid %v, gid %v, egid %v, path %v, err: %v\n", syscall.Getuid(), syscall.Geteuid(), syscall.Getgid(), syscall.Getegid(), path, err)
}

What did you expect to see?

uid 10101, euid 10101, gid 10101, egid 10101, path /, err: <nil>

What did you see instead?

SIGSYS: bad system call
PC=0x5de5eebff0 m=0 sigcode=1

goroutine 1 [syscall]:
syscall.Syscall6(0x7fe2e495b3?, 0x4?, 0x0?, 0x0?, 0x4000046538?, 0x11?, 0x40000465a8?)
	syscall/syscall_linux.go:90 +0x2c fp=0x4000106d30 sp=0x4000106ca0 pc=0x5de5f5e07c
syscall.faccessat2(0x4000046618?, {0x7fe2e495b3?, 0x4000070000?}, 0x4, 0x40000465f8?)
	syscall/zsyscall_linux_arm64.go:33 +0x84 fp=0x4000106da0 sp=0x4000106d30 pc=0x5de5f5d0c4
syscall.Faccessat(0x40000466b8?, {0x7fe2e495b3, 0x4}, 0x4, 0x200)
	syscall/syscall_linux.go:147 +0x3c fp=0x4000106e80 sp=0x4000106da0 pc=0x5de5f5c8bc
main.main()
	foo/hello.go:12 +0x54 fp=0x4000106f70 sp=0x4000106e80 pc=0x5de5f69cc4
runtime.main()
	runtime/proc.go:250 +0x200 fp=0x4000106fd0 sp=0x4000106f70 pc=0x5de5f1bb90
runtime.goexit()
	runtime/asm_arm64.s:1172 +0x4 fp=0x4000106fd0 sp=0x4000106fd0 pc=0x5de5f45854

goroutine 2 [force gc (idle)]:
runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
	runtime/proc.go:381 +0xe0 fp=0x4000046fa0 sp=0x4000046f80 pc=0x5de5f1bfa0
runtime.goparkunlock(...)
	runtime/proc.go:387
runtime.forcegchelper()
	runtime/proc.go:305 +0xb0 fp=0x4000046fd0 sp=0x4000046fa0 pc=0x5de5f1bdf0
runtime.goexit()
	runtime/asm_arm64.s:1172 +0x4 fp=0x4000046fd0 sp=0x4000046fd0 pc=0x5de5f45854
created by runtime.init.6
	runtime/proc.go:293 +0x24

goroutine 3 [GC sweep wait]:
runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
	runtime/proc.go:381 +0xe0 fp=0x4000047760 sp=0x4000047740 pc=0x5de5f1bfa0
runtime.goparkunlock(...)
	runtime/proc.go:387
runtime.bgsweep(0x0?)
	runtime/mgcsweep.go:278 +0x98 fp=0x40000477b0 sp=0x4000047760 pc=0x5de5f094e8
runtime.gcenable.func1()
	runtime/mgc.go:178 +0x28 fp=0x40000477d0 sp=0x40000477b0 pc=0x5de5efe838
runtime.goexit()
	runtime/asm_arm64.s:1172 +0x4 fp=0x40000477d0 sp=0x40000477d0 pc=0x5de5f45854
created by runtime.gcenable
	runtime/mgc.go:178 +0x6c

goroutine 4 [GC scavenge wait]:
runtime.gopark(0x400006e000?, 0x5de5f87530?, 0x1?, 0x0?, 0x0?)
	runtime/proc.go:381 +0xe0 fp=0x4000047f50 sp=0x4000047f30 pc=0x5de5f1bfa0
runtime.goparkunlock(...)
	runtime/proc.go:387
runtime.(*scavengerState).park(0x5de60428a0)
	runtime/mgcscavenge.go:400 +0x5c fp=0x4000047f80 sp=0x4000047f50 pc=0x5de5f0748c
runtime.bgscavenge(0x0?)
	runtime/mgcscavenge.go:628 +0x44 fp=0x4000047fb0 sp=0x4000047f80 pc=0x5de5f079c4
runtime.gcenable.func2()
	runtime/mgc.go:179 +0x28 fp=0x4000047fd0 sp=0x4000047fb0 pc=0x5de5efe7d8
runtime.goexit()
	runtime/asm_arm64.s:1172 +0x4 fp=0x4000047fd0 sp=0x4000047fd0 pc=0x5de5f45854
created by runtime.gcenable
	runtime/mgc.go:179 +0xac

goroutine 17 [finalizer wait]:
runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
	runtime/proc.go:381 +0xe0 fp=0x4000042580 sp=0x4000042560 pc=0x5de5f1bfa0
runtime.runfinq()
	runtime/mfinal.go:193 +0x100 fp=0x40000427d0 sp=0x4000042580 pc=0x5de5efd900
runtime.goexit()
	runtime/asm_arm64.s:1172 +0x4 fp=0x40000427d0 sp=0x40000427d0 pc=0x5de5f45854
created by runtime.createfing
	runtime/mfinal.go:163 +0x80

r0      0x0
r1      0x400009e000
r2      0x4
r3      0x200
r4      0x0
r5      0x0
r6      0x0
r7      0x4
r8      0x1b7
r9      0x400009e000
r10     0x0
r11     0x0
r12     0x7fe2e495b3
r13     0x4
r14     0x3
r15     0x3d6a5b13c0f4
r16     0x40001063a0
r17     0x7fe2e48790
r18     0x0
r19     0x0
r20     0x4000106cf0
r21     0x5de6042d20
r22     0x4000004000
r23     0x4000106e30
r24     0x0
r25     0x0
r26     0x4000106ac0
r27     0x1
r28     0x40000021a0
r29     0x4000106c38
lr      0x5de5eebfac
sp      0x4000106c40
pc      0x5de5eebff0
fault   0x0

Here's the strace line corresponding to the SIGSYS:

--- SIGSYS {si_signo=SIGSYS, si_code=SYS_SECCOMP, si_call_addr=0x576f0e7ff0, si_syscall=__NR_faccessat2, si_arch=AUDIT_ARCH_AARCH64} ---

[ianlancetaylor]

Well that seems dreadful. If faccessat2 is not supported then we expect that system call to return ENOSYS or EPERM. We certainly don't expect the program to be killed by a signal. I don't know how we can handle this case appropriately and safely. Suggestions welcome.

What happens if you ignore the signal using signal.Ignore(syscall.SIGSYS) ?

CC @golang/android

[zorro]

signal.Ignore(syscall.SIGSYS) have no effect

[prattmic]

Android apps run inside of a seccomp sandbox that limits the system calls they can make. (It looks like they use SECCOMP_RET_TRAP which sends a signal but does not unconditionally kill the process).

The allowlist appears to be some combination of the files in this directory (I’m not sure of the details): https://cs.android.com/android/platform/superproject/+/master:bionic/libc/SECCOMP_ALLOWLIST_APP.TXT

I don’t see faccess or faccess2 in these files (only access), so I don’t think there is much we can do here.

[zorro]

@prattmic syscall.Faccessat works fine on go1.19.4. So it looks like Android is blocking only faccessat2 not faccessat

[prattmic]

Ah right. Apologies I missed that in your original message.

[prattmic]

Looking into #57393 (comment) further, it looks like the policy is to allow SYSCALLS.TXT - (SECCOMP_BLOCKLIST_COMMON.TXT + SECCOMP_BLOCKLIST_APP.TXT) + SECCOMP_ALLOWLIST_COMMON.TXT + SECCOMP_ALLOWLIST_APP.TXT [1].

In this case I believe faccess2 is not allowed simply because it isn't defined in the base SYSCALLS.TXT yet (it is a fairly new syscall).

[1] The allowlist seems largely useless? I don't see any syscalls in the allowlist that are also in the blocklist...