tyler.durden/openssh-portable
1
0
Fork 0
mirror of https://github.com/PowerShell/openssh-portable.git synced 2025-07-27 07:44:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

Deny (non-fatal) ipc in preauth privsep child.

Browse Source 
As noted in openssh/openssh-portable#149, i386 does not have have
_NR_shmget etc.  Instead, it has a single ipc syscall (see man 2 ipc,
https://linux.die.net/man/2/ipc).  Add this syscall, if present, to the
list of syscalls that seccomp will deny non-fatally.
This commit is contained in:
Jeremy Drake 2019-10-11 18:31:05 -07:00 committed by Darren Tucker
parent b110cefdfb
commit 30f704ebc0
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
sandbox-seccomp-filter.c
View File

@ -177,6 +177,9 @@ static const struct sock_filter preauth_insns[] = {
#ifdef __NR_shmdt
SC_DENY(__NR_shmdt, EACCES),
#endif
#ifdef __NR_ipc
SC_DENY(__NR_ipc, EACCES),
#endif
/* Syscalls to permit */
#ifdef __NR_brk