summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorEduardo Barretto <ebarretto@linux.vnet.ibm.com>2017-05-09 10:53:04 -0300
committerColin Watson <cjwatson@debian.org>2018-04-03 18:40:49 +0100
commit8435aa5e322a4899dcb9bc68d5f0551e93d3f5a5 (patch)
treefde96e1acb200a434be54accf4a13697d700e39b
parent1e4b9d8e6cee1e15edfc12aa0294fa78639496b9 (diff)
Allow flock and ipc syscall for s390 architecture
In order to use the OpenSSL-ibmpkcs11 engine it is needed to allow flock and ipc calls, because this engine calls OpenCryptoki (a PKCS#11 implementation) which calls the libraries that will communicate with the crypto cards. OpenCryptoki makes use of flock and ipc and, as of now, this is only need on s390 architecture. Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com> Origin: other, https://bugzilla.mindrot.org/show_bug.cgi?id=2752 Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2752 Bug-Ubuntu: https://bugs.launchpad.net/bugs/1686618 Last-Update: 2017-08-28 Patch-Name: seccomp-s390-flock-ipc.patch
-rw-r--r--sandbox-seccomp-filter.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
index ca75cc719..6e7de3114 100644
--- a/sandbox-seccomp-filter.c
+++ b/sandbox-seccomp-filter.c
@@ -166,6 +166,9 @@ static const struct sock_filter preauth_insns[] = {
166#ifdef __NR_exit_group 166#ifdef __NR_exit_group
167 SC_ALLOW(__NR_exit_group), 167 SC_ALLOW(__NR_exit_group),
168#endif 168#endif
169#if defined(__NR_flock) && defined(__s390__)
170 SC_ALLOW(__NR_flock),
171#endif
169#ifdef __NR_getpgid 172#ifdef __NR_getpgid
170 SC_ALLOW(__NR_getpgid), 173 SC_ALLOW(__NR_getpgid),
171#endif 174#endif
@@ -178,6 +181,9 @@ static const struct sock_filter preauth_insns[] = {
178#ifdef __NR_gettimeofday 181#ifdef __NR_gettimeofday
179 SC_ALLOW(__NR_gettimeofday), 182 SC_ALLOW(__NR_gettimeofday),
180#endif 183#endif
184#if defined(__NR_ipc) && defined(__s390__)
185 SC_ALLOW(__NR_ipc),
186#endif
181#ifdef __NR_madvise 187#ifdef __NR_madvise
182 SC_ALLOW(__NR_madvise), 188 SC_ALLOW(__NR_madvise),
183#endif 189#endif