Fix typo in "socketcall".

Pointed out by jjelen at redhat.com.
Deny socketcall in seccomp filter on ppc64le.
2017-04-25 08:34:40 +10:00 · 2017-04-24 19:44:05 +10:00 · 2017-03-29 12:46:11 +11:00 · 2017-03-24 09:46:55 +11:00 · 2017-03-22 12:43:42 +11:00 · 2017-03-21 08:50:42 +11:00
3 changed files with 11 additions and 4 deletions
@@ -1486,6 +1486,7 @@ AC_ARG_WITH(ldns,
 		else
 			LIBS="$LIBS `$LDNSCONFIG --libs`"
 			CPPFLAGS="$CPPFLAGS `$LDNSCONFIG --cflags`"
+			ldns=yes
 		fi
 	elif test "x$withval" != "xno" ; then
 			CPPFLAGS="$CPPFLAGS -I${withval}/include"
@@ -50,6 +50,9 @@
 #include <elf.h>

 #include <asm/unistd.h>
+#ifdef __s390__
+#include <asm/zcrypt.h>
+#endif

 #include <errno.h>
 #include <signal.h>
@@ -222,6 +225,7 @@ static const struct sock_filter preauth_insns[] = {
 #endif
 #ifdef __NR_socketcall
 	SC_ALLOW_ARG(__NR_socketcall, 0, SYS_SHUTDOWN),
+	SC_DENY(__NR_socketcall, EACCES),
 #endif
 #if defined(__NR_ioctl) && defined(__s390__)
 	/* Allow ioctls for ICA crypto card on s390 */
@@ -235,7 +239,7 @@ static const struct sock_filter preauth_insns[] = {
 	 * x86-64 syscall under some circumstances, e.g.
 	 * https://bugs.debian.org/849923
 	 */
-	SC_ALLOW(__NR_clock_gettime & ~__X32_SYSCALL_BIT);
+	SC_ALLOW(__NR_clock_gettime & ~__X32_SYSCALL_BIT),
 #endif

 	/* Default deny */
@@ -223,6 +223,7 @@ int startup_pipe;		/* in child */
 int use_privsep = -1;
 struct monitor *pmonitor = NULL;
 int privsep_is_preauth = 1;
+static int privsep_chroot = 1;

 /* global authentication context */
 Authctxt *the_authctxt = NULL;
@@ -541,7 +542,7 @@ privsep_preauth_child(void)
 	demote_sensitive_data();

 	/* Demote the child */
-	if (getuid() == 0 || geteuid() == 0) {
+	if (privsep_chroot) {
 		/* Change our root directory */
 		if (chroot(_PATH_PRIVSEP_CHROOT_DIR) == -1)
 			fatal("chroot(\"%s\"): %s", _PATH_PRIVSEP_CHROOT_DIR,
@@ -1640,8 +1641,9 @@ main(int ac, char **av)
 	);

 	/* Store privilege separation user for later use if required. */
+	privsep_chroot = use_privsep && (getuid() == 0 || geteuid() == 0);
 	if ((privsep_pw = getpwnam(SSH_PRIVSEP_USER)) == NULL) {
-		if (use_privsep || options.kerberos_authentication)
+		if (privsep_chroot || options.kerberos_authentication)
 			fatal("Privilege separation user %s does not exist",
 			    SSH_PRIVSEP_USER);
 	} else {
@@ -1767,7 +1769,7 @@ main(int ac, char **av)
 		    key_type(key));
 	}

-	if (use_privsep) {
+	if (privsep_chroot) {
 		struct stat st;

 		if ((stat(_PATH_PRIVSEP_CHROOT_DIR, &st) == -1) ||
Author	SHA1	Message	Date
Darren Tucker	c44453e5a2	Fix typo in "socketcall". Pointed out by jjelen at redhat.com.	2017-04-25 08:34:40 +10:00
Darren Tucker	295ac5e153	Deny socketcall in seccomp filter on ppc64le. OpenSSL is using socket() calls (in FIPS mode) when handling ECDSA keys in privsep child. The socket() syscall is already denied in the seccomp filter, but in ppc64le kernel, it is implemented using socketcall() syscall, which is not denied yet (only SYS_SHUTDOWN is allowed) and therefore fails hard. Patch from jjelen at redhat.com.	2017-04-24 19:44:05 +10:00
Darren Tucker	f77e6b5216	Don't check privsep user or path when unprivileged If running with privsep (mandatory now) as a non-privileged user, we don't chroot or change to an unprivileged user however we still checked the existence of the user and directory. Don't do those checks if we're not going to use them. Based in part on a patch from Lionel Fourquaux via Corinna Vinschen, ok djm@	2017-03-29 12:46:11 +11:00
Darren Tucker	4632b63bdc	Enable ldns when using ldns-config. Actually enable ldns when attempting to use ldns-config. bz#2697, patch from fredrik at fornwall.net.	2017-03-24 09:46:55 +11:00
Damien Miller	eb25c7b633	Missing header on Linux/s390 Patch from Jakub Jelen	2017-03-22 12:43:42 +11:00
Damien Miller	173359e4cb	Fix syntax error on Linux/X32 Patch from Mike Frysinger	2017-03-21 08:50:42 +11:00