tyler.durden
/
openssh-portable
mirror of https://github.com/PowerShell/openssh-portable.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Don't auto-enable Capsicum sandbox on FreeBSD 9/10. 

Since we changed from select() to ppoll() tests have been failing.
This seems to be because FreeBSD 10 (and presumably 9) do not allow
ppoll() in the privsep process and sshd will fail with "Not permitted in
capability mode".  Setting CAP_EVENT on the FDs doesn't help, but weirdly,
poll() works without that.  Those versions are EOL so this situation is
unlikely to change.
This commit is contained in:
Darren Tucker 2021-11-19 16:01:51 +11:00
parent a823f39986
commit 04b172da5b
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
configure.ac
View File

@ -994,6 +994,11 @@ mips-sony-bsd|mips-sony-newsos4)
# and will crash if they cannot be opened. # and will crash if they cannot be opened.
AC_DEFINE([SANDBOX_SKIP_RLIMIT_NOFILE], [1], AC_DEFINE([SANDBOX_SKIP_RLIMIT_NOFILE], [1],
[define if setrlimit RLIMIT_NOFILE breaks things]) [define if setrlimit RLIMIT_NOFILE breaks things])
case "$host" in
*-*-freebsd9.*|*-*-freebsd10.*)
# Capsicum on 9 and 10 do not allow ppoll() so don't auto-enable.
disable_capsicum=yes
esac
;; ;;
*-*-bsdi*) *-*-bsdi*)
AC_DEFINE([SETEUID_BREAKS_SETUID]) AC_DEFINE([SETEUID_BREAKS_SETUID])
@ -3654,6 +3659,7 @@ elif test "x$sandbox_arg" = "xseccomp_filter" || \
AC_DEFINE([SANDBOX_SECCOMP_FILTER], [1], [Sandbox using seccomp filter]) AC_DEFINE([SANDBOX_SECCOMP_FILTER], [1], [Sandbox using seccomp filter])
elif test "x$sandbox_arg" = "xcapsicum" || \ elif test "x$sandbox_arg" = "xcapsicum" || \
( test -z "$sandbox_arg" && \ ( test -z "$sandbox_arg" && \
test "x$disable_capsicum" != "xyes" && \
test "x$ac_cv_header_sys_capsicum_h" = "xyes" && \ test "x$ac_cv_header_sys_capsicum_h" = "xyes" && \
test "x$ac_cv_func_cap_rights_limit" = "xyes") ; then test "x$ac_cv_func_cap_rights_limit" = "xyes") ; then
test "x$ac_cv_header_sys_capsicum_h" != "xyes" && \ test "x$ac_cv_header_sys_capsicum_h" != "xyes" && \