Deny (non-fatal) ipc in preauth privsep child.

As noted in openssh/openssh-portable#149, i386 does not have have _NR_shmget etc. Instead, it has a single ipc syscall (see man 2 ipc, https://linux.die.net/man/2/ipc). Add this syscall, if present, to the list of syscalls that seccomp will deny non-fatally.
seccomp: Allow clock_gettime64() in sandbox.
2020-01-08 21:48:37 +11:00 · 2020-01-08 12:21:08 +11:00 · 2020-01-08 12:20:34 +11:00 · 2019-11-13 23:29:05 +11:00 · 2019-11-13 23:23:21 +11:00 · 2019-10-10 09:46:06 +11:00
2 changed files with 13 additions and 1 deletions
@@ -73,7 +73,7 @@ int getpagesize(void);
 char *getcwd(char *pt, size_t size);
 #endif

-#ifdef HAVE_MEMMEM
+#ifndef HAVE_MEMMEM
 void *memmem(const void *, size_t, const void *, size_t);
 #endif

@@ -177,6 +177,9 @@ static const struct sock_filter preauth_insns[] = {
 #ifdef __NR_shmdt
 	SC_DENY(__NR_shmdt, EACCES),
 #endif
+#ifdef __NR_ipc
+	SC_DENY(__NR_ipc, EACCES),
+#endif

 	/* Syscalls to permit */
 #ifdef __NR_brk
@@ -242,6 +245,15 @@ static const struct sock_filter preauth_insns[] = {
 #ifdef __NR_nanosleep
 	SC_ALLOW(__NR_nanosleep),
 #endif
+#ifdef __NR_clock_nanosleep
+	SC_ALLOW(__NR_clock_nanosleep),
+#endif
+#ifdef __NR_clock_nanosleep_time64
+	SC_ALLOW(__NR_clock_nanosleep_time64),
+#endif
+#ifdef __NR_clock_gettime64
+	SC_ALLOW(__NR_clock_gettime64),
+#endif
 #ifdef __NR__newselect
 	SC_ALLOW(__NR__newselect),
 #endif
Author	SHA1	Message	Date
Jeremy Drake	fbe37c9060	Deny (non-fatal) ipc in preauth privsep child. As noted in openssh/openssh-portable#149, i386 does not have have _NR_shmget etc. Instead, it has a single ipc syscall (see man 2 ipc, https://linux.die.net/man/2/ipc). Add this syscall, if present, to the list of syscalls that seccomp will deny non-fatally.	2020-01-08 21:48:37 +11:00
Khem Raj	a991cc5ed5	seccomp: Allow clock_gettime64() in sandbox. This helps sshd accept connections on mips platforms with upcoming glibc ( 2.31 )	2020-01-08 12:21:08 +11:00
Darren Tucker	030b4c2b80	Allow clock_nanosleep_time64 in seccomp sandbox. Needed on Linux ARM. bz#3100, patch from [email protected].	2020-01-08 12:20:34 +11:00
Darren Tucker	69298ebfc2	Remove duplicate __NR_clock_nanosleep	2019-11-13 23:29:05 +11:00
Darren Tucker	beee0ef618	seccomp: Allow clock_nanosleep() in sandbox. seccomp: Allow clock_nanosleep() to make OpenSSH working with latest glibc. Patch from Jakub Jelen <[email protected]> via bz #3093.	2019-11-13 23:23:21 +11:00
Darren Tucker	d43ff22d66	Fix ifdef typo for declaration of memmem. Fixes build on IRIX. bz#3081.	2019-10-10 09:46:06 +11:00