tyler.durden
/
openssh-portable
mirror of https://github.com/PowerShell/openssh-portable.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

use SC_ALLOW_ARG_MASK to limit mmap protections 

Restrict to PROT_(READ|WRITE|NONE), i.e. exclude PROT_EXEC
This commit is contained in:
Damien Miller 2019-08-23 10:19:30 +10:00
parent f6906f9bf1
commit e83c989bfd
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sandbox-seccomp-filter.c
View File

@ -216,10 +216,10 @@ static const struct sock_filter preauth_insns[] = {
SC_ALLOW(__NR_madvise), SC_ALLOW(__NR_madvise),
#endif #endif
#ifdef __NR_mmap #ifdef __NR_mmap
SC_ALLOW(__NR_mmap), SC_ALLOW_ARG_MASK(__NR_mmap, 2, PROT_READ|PROT_WRITE|PROT_NONE),
#endif #endif
#ifdef __NR_mmap2 #ifdef __NR_mmap2
SC_ALLOW(__NR_mmap2), SC_ALLOW_ARG_MASK(__NR_mmap2, 2, PROT_READ|PROT_WRITE|PROT_NONE),
#endif #endif
#ifdef __NR_mprotect #ifdef __NR_mprotect
SC_ALLOW_ARG_MASK(__NR_mprotect, 2, PROT_READ|PROT_WRITE|PROT_NONE), SC_ALLOW_ARG_MASK(__NR_mprotect, 2, PROT_READ|PROT_WRITE|PROT_NONE),