Accepting request 222710 from home:pcerny:factory

- re-enabling the seccomp sandbox
  (allowing use of getuid the syscall)

OBS-URL: https://build.opensuse.org/request/show/222710
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=66

openssh-6.5p1-seccomp_getuid.patch

@@ -0,0 +1,26 @@
+# HG changeset patch
+# Parent d625afd0d51ac51161b25728bc2f227c098fa0fb
+add 'getuid' syscall to list of allowed ones to prevent the sanboxed thread
+from being killed by the seccomp filter
+
+diff --git a/openssh-6.5p1/sandbox-seccomp-filter.c b/openssh-6.5p1/sandbox-seccomp-filter.c
+--- a/openssh-6.5p1/sandbox-seccomp-filter.c
++++ b/openssh-6.5p1/sandbox-seccomp-filter.c
+@@ -85,16 +85,17 @@ static const struct sock_filter preauth_
+ 		offsetof(struct seccomp_data, arch)),
+ 	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SECCOMP_AUDIT_ARCH, 1, 0),
+ 	BPF_STMT(BPF_RET+BPF_K, SECCOMP_FILTER_FAIL),
+ 	/* Load the syscall number for checking. */
+ 	BPF_STMT(BPF_LD+BPF_W+BPF_ABS,
+ 		offsetof(struct seccomp_data, nr)),
+ 	SC_DENY(open, EACCES),
+ 	SC_ALLOW(getpid),
++	SC_ALLOW(getuid),
+ 	SC_ALLOW(gettimeofday),
+ 	SC_ALLOW(clock_gettime),
+ #ifdef __NR_time /* not defined on EABI ARM */
+ 	SC_ALLOW(time),
+ #endif
+ 	SC_ALLOW(read),
+ 	SC_ALLOW(write),
+ 	SC_ALLOW(close),

openssh.changes

@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Tue Feb 18 12:56:31 UTC 2014 - pcerny@suse.com
+
+- re-enabling the seccomp sandbox
+  (allowing use of getuid the syscall)
+
 -------------------------------------------------------------------
 Mon Feb 17 11:29:21 UTC 2014 - pcerny@suse.com
 

openssh.spec

@@ -53,11 +53,11 @@
 %endif
 
 %define sandbox_seccomp 0
-#ifarch %ix86 x86_64
+%ifarch %ix86 x86_64
-#if 0%{?suse_version} > 1220
+%if 0%{?suse_version} > 1220
-#define sandbox_seccomp 0
+%define sandbox_seccomp 1
-#endif
+%endif
-#endif
+%endif
 
 %define _fwdir   %{_sysconfdir}/sysconfig/SuSEfirewall2.d
 %define _fwdefdir   %{_fwdir}/services
@@ -142,6 +142,7 @@ Patch31:        openssh-6.5p1-no_fork-no_pid_file.patch
 Patch32:        openssh-6.5p1-host_ident.patch
 Patch33:        openssh-6.5p1-sftp_homechroot.patch
 Patch34:        openssh-6.5p1-sftp_force_permissions.patch
+Patch35:        openssh-6.5p1-seccomp_getuid.patch
 
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 
@@ -201,6 +202,7 @@ Helper applications for OpenSSH which retrieve keys from various sources.
 %patch32 -p2
 %patch33 -p2
 %patch34 -p2
+%patch35 -p2
 cp %{SOURCE3} %{SOURCE4} .
 
 %build