Backport seccomp sandbox fixes to 18.04

These are all fixed in 2.8.4-1; cosmic has 2.8.4-2.

Hello Colin, or anyone else affected,

Accepted man-db into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/man-db/2.8.3-2ubuntu0.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

I couldn't reproduce the problem with XZ_DEFAULTS=--threads=0 but according to [1], it requires xz-utils >= 5.2.3 and 18.04 has 5.2.2-1.3. I found no regression but I have NOT tested the ESET/VPN cases.

1: https://git.savannah.gnu.org/cgit/man-db.git/commit/?id=8fa6fb5eca612600b3a3d8da811f8345afec102e

Thanks, Colin, for providing the fixes+backport and Brian, for including them into the repository.

I hope the following serves at least as a regression test.

[Test Cases]
1) ESET NOD32 Antivirus4 4.0.90.0 with /etc/ld.so.preload (which serves to files scanning on access)
1a) man-db 2.8.3-2 and xz-utils 5.2.2-1.3 installed from stable ubuntu 18.04 distribution
1b) man-db 2.8.3-2 installed from bionic-proposed and xz-utils 5.2.2-1.3 installed from stable ubuntu 18.04 distribution
1c) man-db 2.8.3-2 installed from bionic-proposed and xz-utils 5.2.2-1.3 installed from stable ubuntu 18.04 distribution, additionally xz-utils 5.2.4 installed to /usr/local (without package)

in all cases 1x) Update of the Manual-DB e.g. by "sudo mandb -c" leads to the error messages:
...
/usr/bin/mandb: zcat < /usr/share/man/man1/lz4_decompress.1.gz: Bad system call
/usr/bin/mandb: /usr/lib/man-db/manconv -f UTF-8:ISO-8859-1 -t UTF-8//IGNORE -q: Bad system call
/usr/bin/mandb: zcat: Bad system call
...

For 1b and 1c this was also tested with XZ_DEFAULTS=--threads=0.

In all cases 1x) "man mandb" formats correctly.
(Maybe that was a problem with earlier ESET versions.)

2) ESET NOD32 Antivirus4 4.0.90.0 without /etc/ld.so.preload
2a) man-db 2.8.3-2 and xz-utils 5.2.2-1.3 installed from stable ubuntu 18.04 distribution
2b) man-db 2.8.3-2 installed from bionic-proposed and xz-utils 5.2.2-1.3 installed from stable ubuntu 18.04 distribution
2c) man-db 2.8.3-2 installed from bionic-proposed and xz-utils 5.2.2-1.3 installed from stable ubuntu 18.04 distribution, additionally xz-utils 5.2.4 installed to /usr/local (without package)

all 2x) ok für man-db generation and formatting of man pages

System Architecture:
i386
Ubuntu 18.04
Kernel Linux pc2 4.15.0-33201808301234-generic #0+mediatree+hauppauge-Ubuntu SMP Thu Aug 30 19:02:06 UTC 2018 i686 i686 i686 GNU/Linu

The mandb problem doesn't occur with my 64bit Ubuntu installation, although ESET is installed there as well!

Conclusion:
The bugfix dosn't resolve my problem, but it doesn't make things worse for me, so if it helps others...

Thanks for providing it.

Thanks. Sounds like I still missed something but it's at least no worse than before, so I think that's good enough for verification-done.

This bug was fixed in the package man-db - 2.8.3-2ubuntu0.1

---------------
man-db (2.8.3-2ubuntu0.1) bionic; urgency=medium

  * Backport seccomp sandbox improvements from 2.8.4 (LP: #1785414):
    - Allow sched_getaffinity, used by xz in some cases.
    - Allow some shared memory operations, required by preloaded libraries
      such as the Astrill VPN.
    - Improve ESET File Security compatibility further.

 -- Colin Watson <email address hidden> Sat, 04 Aug 2018 20:16:12 +0100

The verification of the Stable Release Update for man-db has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.