Java process gets terminated by seccomp because of "name_to_handle_at" syscall usage

[Philipp Lorenz]

I was told to put this issue here in #snappy on irc.freenode.net so it can be tracked.

I'm running the Oracle JVM 8 on my Raspberry Pi 2 on Snappy Ubuntu. The JVM was installed by using the official Raspbian package and it seems to run fine. However, I want to use the "usb4java" framework for listing all USB devices by making the following call:

UsbHostManager.getUsbServices();

This method calls a USB library (libusb4java.so, packed into one of the JAR files) and this somehow seems to make use of the "name_to_handle_at" function - however, this method is never directly called.

Links for further research:
-usb4java: http://usb4java.org/
-usb4java source code: https://github.com/usb4java/usb4java
-libusb4java source code: https://github.com/usb4java/libusb4java

Thanks in advance for any help on this!

[Tyler Hicks (tyhicks)]

Hi Philip - Thanks again for filing this bug.

Per our IRC conversation, you were able to solve your problem by rebuilding and packaging libusb4java yourself. That solved the need for the name_to_handle_at() syscall.

The name_to_handle_at() syscall is one in a family of syscalls that we prefer not to allow in ubuntu-core-security due to concerns about file handles being used to break out of confinement.

I'm going to mark this bug as Won't Fix. Please let us know if you hit this issue again and we can discuss possible solutions again. Thanks!