tyler.durden
/
openssh-portable
mirror of https://github.com/PowerShell/openssh-portable.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Cache timezone data in capsicum sandbox. 

From emaste at freebsd.org, originally part of FreeBSD commit r339216
/ fc3c19a9 with autoconf bits added by me.
This commit is contained in:
Darren Tucker 2022-04-23 20:17:26 +10:00
parent c31404426d
commit 4cc05de568
2 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
configure.ac
View File

@ -504,12 +504,20 @@ AC_CHECK_HEADERS([sys/audit.h], [], [], [
]) ])
# sys/capsicum.h requires sys/types.h # sys/capsicum.h requires sys/types.h
AC_CHECK_HEADERS([sys/capsicum.h], [], [], [ AC_CHECK_HEADERS([sys/capsicum.h capsicum_helpers.h], [], [], [
#ifdef HAVE_SYS_TYPES_H #ifdef HAVE_SYS_TYPES_H
# include <sys/types.h> # include <sys/types.h>
#endif #endif
]) ])
AC_MSG_CHECKING([for caph_cache_tzdata])
AC_LINK_IFELSE(
[AC_LANG_PROGRAM([[ #include <capsicum_helpers.h> ]],
[[caph_cache_tzdata();]])],
[ AC_MSG_RESULT([yes]) ],
[ AC_MSG_RESULT([no]) ]
)
# net/route.h requires sys/socket.h and sys/types.h. # net/route.h requires sys/socket.h and sys/types.h.
# sys/sysctl.h also requires sys/param.h # sys/sysctl.h also requires sys/param.h
AC_CHECK_HEADERS([net/route.h sys/sysctl.h], [], [], [ AC_CHECK_HEADERS([net/route.h sys/sysctl.h], [], [], [

7
sandbox-capsicum.c
View File

@ -29,6 +29,9 @@
#include <stdlib.h> #include <stdlib.h>
#include <string.h> #include <string.h>
#include <unistd.h> #include <unistd.h>
#ifdef HAVE_CAPSICUM_HELPERS_H
#include <capsicum_helpers.h>
#endif
#include "log.h" #include "log.h"
#include "monitor.h" #include "monitor.h"
@ -69,6 +72,10 @@ ssh_sandbox_child(struct ssh_sandbox *box)
struct rlimit rl_zero; struct rlimit rl_zero;
cap_rights_t rights; cap_rights_t rights;
#ifdef HAVE_CAPH_CACHE_TZDATA
caph_cache_tzdata();
#endif
rl_zero.rlim_cur = rl_zero.rlim_max = 0; rl_zero.rlim_cur = rl_zero.rlim_max = 0;
if (setrlimit(RLIMIT_FSIZE, &rl_zero) == -1) if (setrlimit(RLIMIT_FSIZE, &rl_zero) == -1)