summaryrefslogtreecommitdiff
path: root/debian/patches/seccomp-getuid-geteuid.patch
diff options
context:
space:
mode:
authorColin Watson <cjwatson@debian.org>2017-08-28 12:14:23 +0100
committerColin Watson <cjwatson@debian.org>2017-08-28 12:15:42 +0100
commit305960d0d6d1d9bc0edc3393383fd5f60e69dec4 (patch)
treec7d5abc0f998a53446e0a15524c08bfb93f9627b /debian/patches/seccomp-getuid-geteuid.patch
parente1c5c61f519b8ef0c210c7949789cfb33ad0cf13 (diff)
parent375f99251da3754666750fe1ed63575ba909f397 (diff)
Apply patches from https://bugzilla.mindrot.org/show_bug.cgi?id=2752 to allow some extra syscalls for crypto cards on s390x (LP: #1686618).
Diffstat (limited to 'debian/patches/seccomp-getuid-geteuid.patch')
-rw-r--r--debian/patches/seccomp-getuid-geteuid.patch44
1 files changed, 44 insertions, 0 deletions
diff --git a/debian/patches/seccomp-getuid-geteuid.patch b/debian/patches/seccomp-getuid-geteuid.patch
new file mode 100644
index 000000000..c829abaa9
--- /dev/null
+++ b/debian/patches/seccomp-getuid-geteuid.patch
@@ -0,0 +1,44 @@
1From b2195f2116754f99fff8ceae026931be3aa3cd3b Mon Sep 17 00:00:00 2001
2From: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
3Date: Tue, 9 May 2017 13:31:05 -0300
4Subject: Allow getuid and geteuid calls
5
6getuid and geteuid are needed when using an openssl engine that calls a
7crypto card, e.g. ICA (libica).
8Those syscalls are also needed by the distros for audit code.
9
10Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
11
12Origin: other, https://bugzilla.mindrot.org/show_bug.cgi?id=2752
13Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2752
14Bug-Ubuntu: https://bugs.launchpad.net/bugs/1686618
15Last-Update: 2017-08-28
16
17Patch-Name: seccomp-getuid-geteuid.patch
18---
19 sandbox-seccomp-filter.c | 12 ++++++++++++
20 1 file changed, 12 insertions(+)
21
22diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
23index 997b66ff..4cbaaa2e 100644
24--- a/sandbox-seccomp-filter.c
25+++ b/sandbox-seccomp-filter.c
26@@ -175,6 +175,18 @@ static const struct sock_filter preauth_insns[] = {
27 #ifdef __NR_getpid
28 SC_ALLOW(__NR_getpid),
29 #endif
30+#ifdef __NR_getuid
31+ SC_ALLOW(__NR_getuid),
32+#endif
33+#ifdef __NR_getuid32
34+ SC_ALLOW(__NR_getuid32),
35+#endif
36+#ifdef __NR_geteuid
37+ SC_ALLOW(__NR_geteuid),
38+#endif
39+#ifdef __NR_geteuid32
40+ SC_ALLOW(__NR_geteuid32),
41+#endif
42 #ifdef __NR_getrandom
43 SC_ALLOW(__NR_getrandom),
44 #endif