Apply patches from https://bugzilla.mindrot.org/show_bug.cgi?id=2752 to allow some extra syscalls for crypto cards on s390x (LP: #1686618).

1 files changed, 44 insertions, 0 deletions

diff --git a/debian/patches/seccomp-getuid-geteuid.patch b/debian/patches/seccomp-getuid-geteuid.patch
new file mode 100644
index 000000000..c829abaa9
--- /dev/null
+++ b/debian/patches/seccomp-getuid-geteuid.patch
@@ -0,0 +1,44 @@
+From b2195f2116754f99fff8ceae026931be3aa3cd3b Mon Sep 17 00:00:00 2001
+From: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
+Date: Tue, 9 May 2017 13:31:05 -0300
+Subject: Allow getuid and geteuid calls
+
+getuid and geteuid are needed when using an openssl engine that calls a
+crypto card, e.g. ICA (libica).
+Those syscalls are also needed by the distros for audit code.
+
+Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
+
+Origin: other, https://bugzilla.mindrot.org/show_bug.cgi?id=2752
+Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2752
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1686618
+Last-Update: 2017-08-28
+
+Patch-Name: seccomp-getuid-geteuid.patch
+---
+ sandbox-seccomp-filter.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
+index 997b66ff..4cbaaa2e 100644
+--- a/sandbox-seccomp-filter.c
++++ b/sandbox-seccomp-filter.c
+@@ -175,6 +175,18 @@ static const struct sock_filter preauth_insns[] = {
+ #ifdef __NR_getpid
+        SC_ALLOW(__NR_getpid),
+ #endif
++#ifdef __NR_getuid
++       SC_ALLOW(__NR_getuid),
++#endif
++#ifdef __NR_getuid32
++       SC_ALLOW(__NR_getuid32),
++#endif
++#ifdef __NR_geteuid
++       SC_ALLOW(__NR_geteuid),
++#endif
++#ifdef __NR_geteuid32
++       SC_ALLOW(__NR_geteuid32),
++#endif
+ #ifdef __NR_getrandom
+        SC_ALLOW(__NR_getrandom),
+ #endif