pool/openssh
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Accepting request 222710 from home:pcerny:factory

Browse Source 
- re-enabling the seccomp sandbox
  (allowing use of getuid the syscall)

OBS-URL: https://build.opensuse.org/request/show/222710
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=66
This commit is contained in:
Petr Cerny 2014-02-18 13:04:57 +00:00 committed by Git OBS Bridge
parent eedbb4ea75
commit f2774839fb
3 changed files with 39 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
openssh-6.5p1-seccomp_getuid.patch Normal file
View File

@ -0,0 +1,26 @@
# HG changeset patch
# Parent d625afd0d51ac51161b25728bc2f227c098fa0fb
add 'getuid' syscall to list of allowed ones to prevent the sanboxed thread
from being killed by the seccomp filter
diff --git a/openssh-6.5p1/sandbox-seccomp-filter.c b/openssh-6.5p1/sandbox-seccomp-filter.c
--- a/openssh-6.5p1/sandbox-seccomp-filter.c
+++ b/openssh-6.5p1/sandbox-seccomp-filter.c
@@ -85,16 +85,17 @@ static const struct sock_filter preauth_
offsetof(struct seccomp_data, arch)),
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SECCOMP_AUDIT_ARCH, 1, 0),
BPF_STMT(BPF_RET+BPF_K, SECCOMP_FILTER_FAIL),
/* Load the syscall number for checking. */
BPF_STMT(BPF_LD+BPF_W+BPF_ABS,
offsetof(struct seccomp_data, nr)),
SC_DENY(open, EACCES),
SC_ALLOW(getpid),
+ SC_ALLOW(getuid),
SC_ALLOW(gettimeofday),
SC_ALLOW(clock_gettime),
#ifdef __NR_time /* not defined on EABI ARM */
SC_ALLOW(time),
#endif
SC_ALLOW(read),
SC_ALLOW(write),
SC_ALLOW(close),

6
openssh.changes
View File

@ -1,3 +1,9 @@
-------------------------------------------------------------------
Tue Feb 18 12:56:31 UTC 2014 - pcerny@suse.com
- re-enabling the seccomp sandbox
(allowing use of getuid the syscall)
-------------------------------------------------------------------
Mon Feb 17 11:29:21 UTC 2014 - pcerny@suse.com

12
openssh.spec
View File

@ -53,11 +53,11 @@
%endif
%define sandbox_seccomp 0
#ifarch %ix86 x86_64
#if 0%{?suse_version} > 1220
#define sandbox_seccomp 0
#endif
#endif
%ifarch %ix86 x86_64
%if 0%{?suse_version} > 1220
%define sandbox_seccomp 1
%endif
%endif
%define _fwdir %{_sysconfdir}/sysconfig/SuSEfirewall2.d
%define _fwdefdir %{_fwdir}/services
@ -142,6 +142,7 @@ Patch31: openssh-6.5p1-no_fork-no_pid_file.patch
Patch32: openssh-6.5p1-host_ident.patch
Patch33: openssh-6.5p1-sftp_homechroot.patch
Patch34: openssh-6.5p1-sftp_force_permissions.patch
Patch35: openssh-6.5p1-seccomp_getuid.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-build
@ -201,6 +202,7 @@ Helper applications for OpenSSH which retrieve keys from various sources.
%patch32 -p2
%patch33 -p2
%patch34 -p2
%patch35 -p2
cp %{SOURCE3} %{SOURCE4} .
%build