From a8476cc3013b8303167fec09ffe03ed7ca193646 Mon Sep 17 00:00:00 2001 From: Thomas Deutschmann Date: Tue, 8 Oct 2019 17:47:34 +0200 Subject: net-misc/openssh: adjust sandbox for >=dev-libs/openssl-1.1.1d Link: https://github.com/openssh/openssh-portable/pull/149 Bug: https://bugs.gentoo.org/696950 Package-Manager: Portage-2.3.76, Repoman-2.3.17 Signed-off-by: Thomas Deutschmann --- ...mget-shmat-shmdt-in-preauth-privsep-child.patch | 31 ++++++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 net-misc/openssh/files/openssh-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch (limited to 'net-misc/openssh/files') diff --git a/net-misc/openssh/files/openssh-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch b/net-misc/openssh/files/openssh-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch new file mode 100644 index 000000000000..fe3be2409e2a --- /dev/null +++ b/net-misc/openssh/files/openssh-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch @@ -0,0 +1,31 @@ +From 3ef92a657444f172b61f92d5da66d94fa8265602 Mon Sep 17 00:00:00 2001 +From: Lonnie Abelbeck +Date: Tue, 1 Oct 2019 09:05:09 -0500 +Subject: [PATCH] Deny (non-fatal) shmget/shmat/shmdt in preauth privsep child. + +New wait_random_seeded() function on OpenSSL 1.1.1d uses shmget, shmat, and shmdt +in the preauth codepath, deny (non-fatal) in seccomp_filter sandbox. +--- + sandbox-seccomp-filter.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c +index 840c5232b..39dc289e3 100644 +--- a/sandbox-seccomp-filter.c ++++ b/sandbox-seccomp-filter.c +@@ -168,6 +168,15 @@ static const struct sock_filter preauth_insns[] = { + #ifdef __NR_stat64 + SC_DENY(__NR_stat64, EACCES), + #endif ++#ifdef __NR_shmget ++ SC_DENY(__NR_shmget, EACCES), ++#endif ++#ifdef __NR_shmat ++ SC_DENY(__NR_shmat, EACCES), ++#endif ++#ifdef __NR_shmdt ++ SC_DENY(__NR_shmdt, EACCES), ++#endif + + /* Syscalls to permit */ + #ifdef __NR_brk -- cgit v1.2.3-65-gdbad