28 lines
970 B
Diff
28 lines
970 B
Diff
# HG changeset patch
|
|
# Parent d625afd0d51ac51161b25728bc2f227c098fa0fb
|
|
add 'getuid' syscall to list of allowed ones to prevent the sanboxed thread
|
|
from being killed by the seccomp filter
|
|
|
|
diff --git a/openssh-6.5p1/sandbox-seccomp-filter.c b/openssh-6.5p1/sandbox-seccomp-filter.c
|
|
--- a/openssh-6.5p1/sandbox-seccomp-filter.c
|
|
+++ b/openssh-6.5p1/sandbox-seccomp-filter.c
|
|
@@ -85,16 +85,18 @@ static const struct sock_filter preauth_
|
|
offsetof(struct seccomp_data, arch)),
|
|
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SECCOMP_AUDIT_ARCH, 1, 0),
|
|
BPF_STMT(BPF_RET+BPF_K, SECCOMP_FILTER_FAIL),
|
|
/* Load the syscall number for checking. */
|
|
BPF_STMT(BPF_LD+BPF_W+BPF_ABS,
|
|
offsetof(struct seccomp_data, nr)),
|
|
SC_DENY(open, EACCES),
|
|
SC_ALLOW(getpid),
|
|
+ SC_ALLOW(getuid),
|
|
+ SC_ALLOW(getuid32),
|
|
SC_ALLOW(gettimeofday),
|
|
SC_ALLOW(clock_gettime),
|
|
#ifdef __NR_time /* not defined on EABI ARM */
|
|
SC_ALLOW(time),
|
|
#endif
|
|
SC_ALLOW(read),
|
|
SC_ALLOW(write),
|
|
SC_ALLOW(close),
|