openssh/openssh-6.5p1-seccomp_getuid.patch

# HG changeset patch
# Parent d625afd0d51ac51161b25728bc2f227c098fa0fb
add 'getuid' syscall to list of allowed ones to prevent the sanboxed thread
from being killed by the seccomp filter

diff --git a/openssh-6.5p1/sandbox-seccomp-filter.c b/openssh-6.5p1/sandbox-seccomp-filter.c
--- a/openssh-6.5p1/sandbox-seccomp-filter.c
+++ b/openssh-6.5p1/sandbox-seccomp-filter.c
@@ -85,16 +85,20 @@ static const struct sock_filter preauth_
 		offsetof(struct seccomp_data, arch)),
 	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SECCOMP_AUDIT_ARCH, 1, 0),
 	BPF_STMT(BPF_RET+BPF_K, SECCOMP_FILTER_FAIL),
 	/* Load the syscall number for checking. */
 	BPF_STMT(BPF_LD+BPF_W+BPF_ABS,
 		offsetof(struct seccomp_data, nr)),
 	SC_DENY(open, EACCES),
 	SC_ALLOW(getpid),
+	SC_ALLOW(getuid),
+#ifdef __NR_getuid32
+	SC_ALLOW(getuid32),
+#endif
 	SC_ALLOW(gettimeofday),
 	SC_ALLOW(clock_gettime),
 #ifdef __NR_time /* not defined on EABI ARM */
 	SC_ALLOW(time),
 #endif
 	SC_ALLOW(read),
 	SC_ALLOW(write),
 	SC_ALLOW(close),
Accepting request 222710 from home:pcerny:factory - re-enabling the seccomp sandbox (allowing use of getuid the syscall) OBS-URL: https://build.opensuse.org/request/show/222710 OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=66 2014-02-18 14:04:57 +01:00			`# HG changeset patch`
			`# Parent d625afd0d51ac51161b25728bc2f227c098fa0fb`
			`add 'getuid' syscall to list of allowed ones to prevent the sanboxed thread`
			`from being killed by the seccomp filter`

			`diff --git a/openssh-6.5p1/sandbox-seccomp-filter.c b/openssh-6.5p1/sandbox-seccomp-filter.c`
			`--- a/openssh-6.5p1/sandbox-seccomp-filter.c`
			`+++ b/openssh-6.5p1/sandbox-seccomp-filter.c`
- openssh-6.5p1-seccomp_getuid.patch: re-enabling the seccomp sandbox (allowing use of the getuid syscall) (bnc#864171) OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=68 2014-02-19 14:30:54 +01:00			`@@ -85,16 +85,20 @@ static const struct sock_filter preauth_`
Accepting request 222710 from home:pcerny:factory - re-enabling the seccomp sandbox (allowing use of getuid the syscall) OBS-URL: https://build.opensuse.org/request/show/222710 OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=66 2014-02-18 14:04:57 +01:00			`offsetof(struct seccomp_data, arch)),`
			`BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SECCOMP_AUDIT_ARCH, 1, 0),`
			`BPF_STMT(BPF_RET+BPF_K, SECCOMP_FILTER_FAIL),`
			`/* Load the syscall number for checking. */`
			`BPF_STMT(BPF_LD+BPF_W+BPF_ABS,`
			`offsetof(struct seccomp_data, nr)),`
			`SC_DENY(open, EACCES),`
			`SC_ALLOW(getpid),`
			`+ SC_ALLOW(getuid),`
- openssh-6.5p1-seccomp_getuid.patch: re-enabling the seccomp sandbox (allowing use of the getuid syscall) (bnc#864171) OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=68 2014-02-19 14:30:54 +01:00			`+#ifdef __NR_getuid32`
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=67 2014-02-19 14:22:51 +01:00			`+ SC_ALLOW(getuid32),`
- openssh-6.5p1-seccomp_getuid.patch: re-enabling the seccomp sandbox (allowing use of the getuid syscall) (bnc#864171) OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=68 2014-02-19 14:30:54 +01:00			`+#endif`
Accepting request 222710 from home:pcerny:factory - re-enabling the seccomp sandbox (allowing use of getuid the syscall) OBS-URL: https://build.opensuse.org/request/show/222710 OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=66 2014-02-18 14:04:57 +01:00			`SC_ALLOW(gettimeofday),`
			`SC_ALLOW(clock_gettime),`
			`#ifdef __NR_time /* not defined on EABI ARM */`
			`SC_ALLOW(time),`
			`#endif`
			`SC_ALLOW(read),`
			`SC_ALLOW(write),`
			`SC_ALLOW(close),`