diff options
| author |   Thomas Deutschmann <whissi@gentoo.org> | 2019-10-08 17:47:34 +0200 |
|---|---|---|
| committer | Thomas Deutschmann <whissi@gentoo.org> | 2019-10-08 17:47:34 +0200 |
| commit | a8476cc3013b8303167fec09ffe03ed7ca193646 (patch) | |
| tree | 9fd47ef8271e79712c2be4aae9bec7396ebf813f /net-misc/openssh/files | |
| parent | dev-db/phpmyadmin-4.9.1: bump (diff) | |
| download | gentoo-a8476cc3013b8303167fec09ffe03ed7ca193646.tar.gz gentoo-a8476cc3013b8303167fec09ffe03ed7ca193646.tar.bz2 gentoo-a8476cc3013b8303167fec09ffe03ed7ca193646.zip | |
net-misc/openssh: adjust sandbox for >=dev-libs/openssl-1.1.1d
Link: https://github.com/openssh/openssh-portable/pull/149
Bug: https://bugs.gentoo.org/696950
Package-Manager: Portage-2.3.76, Repoman-2.3.17
Signed-off-by: Thomas Deutschmann <whissi@gentoo.org>
Diffstat (limited to 'net-misc/openssh/files')
| -rw-r--r-- | net-misc/openssh/files/openssh-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch | 31 |
1 files changed, 31 insertions, 0 deletions
diff --git a/net-misc/openssh/files/openssh-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch b/net-misc/openssh/files/openssh-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch new file mode 100644 index 000000000000..fe3be2409e2a --- /dev/null +++ b/net-misc/openssh/files/openssh-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch @@ -0,0 +1,31 @@ +From 3ef92a657444f172b61f92d5da66d94fa8265602 Mon Sep 17 00:00:00 2001 +From: Lonnie Abelbeck <lonnie@abelbeck.com> +Date: Tue, 1 Oct 2019 09:05:09 -0500 +Subject: [PATCH] Deny (non-fatal) shmget/shmat/shmdt in preauth privsep child. + +New wait_random_seeded() function on OpenSSL 1.1.1d uses shmget, shmat, and shmdt +in the preauth codepath, deny (non-fatal) in seccomp_filter sandbox. +--- + sandbox-seccomp-filter.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c +index 840c5232b..39dc289e3 100644 +--- a/sandbox-seccomp-filter.c ++++ b/sandbox-seccomp-filter.c +@@ -168,6 +168,15 @@ static const struct sock_filter preauth_insns[] = { + #ifdef __NR_stat64 + SC_DENY(__NR_stat64, EACCES), + #endif ++#ifdef __NR_shmget ++ SC_DENY(__NR_shmget, EACCES), ++#endif ++#ifdef __NR_shmat ++ SC_DENY(__NR_shmat, EACCES), ++#endif ++#ifdef __NR_shmdt ++ SC_DENY(__NR_shmdt, EACCES), ++#endif + + /* Syscalls to permit */ + #ifdef __NR_brk |