Segmentation fault when sandboxing python3 scripts

[descrip]

Running Ubuntu 16.04.1 LTS on a 64-bit system. I made the following script, helloworld.py:

print('Hello world!')

Running the following command with python3 (Python 3.5.2), I received a segmentation fault:

$ mbox -n -i -- python3 helloworld.py
Segmentation fault (core dumped)
Hello world!

The segfault is printed before the expected output, so I think it comes from mbox and not python3.

No segfault is received when running with python2 (Python 2.7.12):

$ mbox -n -i -- python2 helloworld.py
Hello world!

The segfault is still present if mbox is not provided with any arguments.

[uvworkspace]

I tried installing both python3.6 and python3.4. At least python3.4 works.

[livibetter]

tl;dr patch at near end. It only affects Python 3.5+ and it's because syscall getrandom(2) isn't supported in mbox.

I was just passing by and took a look of this, if you run with -d debug message, you will see segfault like this, with a131424:

$ ./mbox -d -- python3.5 -c 'print("Hello World!")'
[snip]
> [20877] close(3
< )                   = 0
> [20877] futex(0x7f03c7bed888, FUTEX_WAKE_PRIVATE, 2147483647
< ) = 0
> [20877] syscall_318(0x7f03c82e12f0, 0x18, 0x1, 0x818, 0x55951fb4d070, 0x7f03c7bed800
Segmentation fault

The syscall 318 is sys_getrandom, see Linux source arch/x86/entry/syscalls/syscall_64.tbl, and it's use in Python since 3.5:

The urandom() function now uses the getrandom() syscall on Linux 3.17 or newer, and getentropy() on OpenBSD 5.6 and newer, removing the need to use /dev/urandom and avoiding failures due to potential file descriptor exhaustion. (Contributed by Victor Stinner in bpo-22181.)

If you write a C code to call that syscall, run in mbox, you get the same segfault. getrandom(2) only has 3 arguments, but as you can see, the call has 6, don't know why or if it's accurate in the printout.

This is why it only affects Python 3.5+. And it's clear to me, the issue is within mbox, especially after I run with strace, which showed correct call and no segfault. (mbox seems to be based on strace)

The getrandom(2) was added in Linux kernel 3.17 in 2014, wrapped in glibc 2.25 in 2017-02-05, see also this article, more would adopt it, using it over reading /dev/urandom, I believe.

I've written a simple fix, see the attached patch, but I'm not bothered creating a PR since there isn't any responses from the owner for a few years, and more importantly, I don't exactly know how to properly to add a new syscall into mbox.

0001-add-sys_getrandom-x86_64-syscall-318.patch.txt

---

In Python 3.4, it does the following:

> [20871] open("/dev/urandom", O_RDONLY|O_CLOEXEC
< ) = 3

So is in 2.7, but you have to actually call it. (Python 3.4/3.5 startup reads urandom / calls getrandom())

./mbox -d -- python2.7 -c 'import os; print(repr(os.urandom(1)))'

[uvworkspace]

It's beyond me, but I've patched and played with it a bit and see it working . Thanks a lot.