openssh/openssh-7.6p1-seccomp_getuid.patch

# HG changeset patch
# Parent  004731f82470b22b9bd563ef3216034cf00ba133
add 'getuid' syscall to list of allowed ones to prevent the sanboxed thread
from being killed by the seccomp filter

diff --git a/openssh-7.6p1/sandbox-seccomp-filter.c b/openssh-7.6p1/sandbox-seccomp-filter.c
--- a/openssh-7.6p1/sandbox-seccomp-filter.c
+++ b/openssh-7.6p1/sandbox-seccomp-filter.c
@@ -173,16 +173,22 @@ static const struct sock_filter preauth_
 	SC_ALLOW(__NR_getpid),
 #endif
 #ifdef __NR_getrandom
 	SC_ALLOW(__NR_getrandom),
 #endif
 #ifdef __NR_gettimeofday
 	SC_ALLOW(__NR_gettimeofday),
 #endif
+#ifdef __NR_getuid
+	SC_ALLOW(__NR_getuid),
+#endif
+#ifdef __NR_getuid32
+	SC_ALLOW(__NR_getuid32),
+#endif
 #ifdef __NR_madvise
 	SC_ALLOW(__NR_madvise),
 #endif
 #ifdef __NR_mmap
 	SC_ALLOW(__NR_mmap),
 #endif
 #ifdef __NR_mmap2
 	SC_ALLOW(__NR_mmap2),
Accepting request 539322 from home:pcerny:factory - upgrade to 7.6p1 see main package changelog for details - Update to vanilla 7.6p1 Most important changes (more details below): * complete removal of the ancient SSHv1 protocol * sshd(8) cannot run without privilege separation * removal of suport for arcfourm blowfish and CAST ciphers and RIPE-MD160 HMAC * refuse RSA keys shorter than 1024 bits Distilled upstream log: - OpenSSH 7.3 ---- Security * sshd(8): Mitigate a potential denial-of-service attack against the system's crypt(3) function via sshd(8). An attacker could send very long passwords that would cause excessive CPU use in crypt(3). sshd(8) now refuses to accept password authentication requests of length greater than 1024 characters. Independently reported by Tomas Kuthan (Oracle), Andres Rojas and Javier Nieto. * sshd(8): Mitigate timing differences in password authentication that could be used to discern valid from invalid account names when long passwords were sent and particular password hashing algorithms are in use on the server. CVE-2016-6210, reported by EddieEzra.Harari at verint.com * ssh(1), sshd(8): Fix observable timing weakness in the CBC padding oracle countermeasures. Reported by Jean Paul Degabriele, Kenny Paterson, Torben Hansen and Martin Albrecht. Note that CBC ciphers are disabled by default and OBS-URL: https://build.opensuse.org/request/show/539322 OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=122 2017-11-06 15:50:53 +01:00			`# HG changeset patch`
			`# Parent 004731f82470b22b9bd563ef3216034cf00ba133`
			`add 'getuid' syscall to list of allowed ones to prevent the sanboxed thread`
			`from being killed by the seccomp filter`

			`diff --git a/openssh-7.6p1/sandbox-seccomp-filter.c b/openssh-7.6p1/sandbox-seccomp-filter.c`
			`--- a/openssh-7.6p1/sandbox-seccomp-filter.c`
			`+++ b/openssh-7.6p1/sandbox-seccomp-filter.c`
			`@@ -173,16 +173,22 @@ static const struct sock_filter preauth_`
			`SC_ALLOW(__NR_getpid),`
			`#endif`
			`#ifdef __NR_getrandom`
			`SC_ALLOW(__NR_getrandom),`
			`#endif`
			`#ifdef __NR_gettimeofday`
			`SC_ALLOW(__NR_gettimeofday),`
			`#endif`
			`+#ifdef __NR_getuid`
			`+ SC_ALLOW(__NR_getuid),`
			`+#endif`
			`+#ifdef __NR_getuid32`
			`+ SC_ALLOW(__NR_getuid32),`
			`+#endif`
			`#ifdef __NR_madvise`
			`SC_ALLOW(__NR_madvise),`
			`#endif`
			`#ifdef __NR_mmap`
			`SC_ALLOW(__NR_mmap),`
			`#endif`
			`#ifdef __NR_mmap2`
			`SC_ALLOW(__NR_mmap2),`