forked from pool/openssh
Antonio Larrosa
fef1b16e66
commented out). The keycat binary isn't really installed nor supported, so we can drop it, except for the code that is used by other SELinux patches, which is what I kept from that patch (boo#1229072). - Add patch submitted to upstream to fix RFC4256 implementation so that keyboard-interactive authentication method can send instructions and sshd shows them to users even before a prompt is requested. This fixes MFA push notifications (boo#1229010). * 0001-auth-pam-Immediately-report-instructions-to-clients-and-fix-handling-in-ssh-client.patch OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=274
42 lines
1.4 KiB
Diff
42 lines
1.4 KiB
Diff
# HG changeset patch
|
|
# Parent 9d38b7292619a6d5faf554b1a88888fdfa535de7
|
|
Patch from IBM enabling the use of OpenCryptoki, submitted upstreams:
|
|
|
|
From: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
|
|
To: openssh-unix-dev@mindrot.org
|
|
Subject: [PATCH 1/3] Allow flock and ipc syscall for s390 architecture
|
|
Date: Tue, 9 May 2017 14:27:13 -0300
|
|
|
|
In order to use the OpenSSL-ibmpkcs11 engine it is needed to allow flock
|
|
and ipc calls, because this engine calls OpenCryptoki (a PKCS#11
|
|
implementation) which calls the libraries that will communicate with the
|
|
crypto cards. OpenCryptoki makes use of flock and ipc and, as of now,
|
|
this is only need on s390 architecture.
|
|
|
|
Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
|
|
|
|
Index: openssh-8.8p1/sandbox-seccomp-filter.c
|
|
===================================================================
|
|
--- openssh-8.8p1.orig/sandbox-seccomp-filter.c
|
|
+++ openssh-8.8p1/sandbox-seccomp-filter.c
|
|
@@ -219,6 +219,9 @@ static const struct sock_filter preauth_
|
|
#ifdef __NR_geteuid32
|
|
SC_ALLOW(__NR_geteuid32),
|
|
#endif
|
|
+#if defined(__NR_flock) && defined(__s390__)
|
|
+ SC_ALLOW(__NR_flock),
|
|
+#endif
|
|
#ifdef __NR_getpgid
|
|
SC_ALLOW(__NR_getpgid),
|
|
#endif
|
|
@@ -237,6 +240,9 @@ static const struct sock_filter preauth_
|
|
#ifdef __NR_getuid32
|
|
SC_ALLOW(__NR_getuid32),
|
|
#endif
|
|
+#if defined(__NR_ipc) && defined(__s390__)
|
|
+ SC_ALLOW(__NR_ipc),
|
|
+#endif
|
|
#ifdef __NR_madvise
|
|
SC_ALLOW_ARG(__NR_madvise, 2, MADV_NORMAL),
|
|
# ifdef MADV_FREE
|