Allow (but return EACCES) fstatat64 in sandbox.

This is apparently used in some configurations of OpenSSL when glibc has getrandom(). bz#3276, patch from Kris Karas, ok djm@
Move generic includes outside of ifdef.
2021-03-12 16:03:51 +11:00 · 2021-03-12 13:19:22 +11:00
2 changed files with 7 additions and 4 deletions
@@ -17,8 +17,6 @@
 #include "config.h"
 #include "includes.h"

-#ifdef USE_SOLARIS_PROCESS_CONTRACTS
-
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <sys/param.h>
@@ -31,12 +29,14 @@
 #include <string.h>
 #include <unistd.h>

+#include "log.h"
+
+#ifdef USE_SOLARIS_PROCESS_CONTRACTS
+
 #include <libcontract.h>
 #include <sys/contract/process.h>
 #include <sys/ctfs.h>

-#include "log.h"
-
 #define CT_TEMPLATE	CTFS_ROOT "/process/template"
 #define CT_LATEST	CTFS_ROOT "/process/latest"

@@ -154,6 +154,9 @@ static const struct sock_filter preauth_insns[] = {
 #ifdef __NR_fstat64
 	SC_DENY(__NR_fstat64, EACCES),
 #endif
+#ifdef __NR_fstatat64
+	SC_DENY(__NR_fstatat64, EACCES),
+#endif
 #ifdef __NR_open
 	SC_DENY(__NR_open, EACCES),
 #endif