seccomp: Allow clock_nanosleep() and variants

6 files changed, 102 insertions, 2 deletions

diff --git a/debian/.git-dpm b/debian/.git-dpm
index ae884c895..c1b3b255f 100644
--- a/debian/.git-dpm
+++ b/debian/.git-dpm
@@ -1,6 +1,6 @@
 # see git-dpm(1) from git-dpm package
-df3ad29af495185aa9b051028ae94b965a4b1659
-df3ad29af495185aa9b051028ae94b965a4b1659
+93e9440bae1818746e0cc7f2543001db9d0ea1ea
+93e9440bae1818746e0cc7f2543001db9d0ea1ea
 4213eec74e74de6310c27a40c3e9759a08a73996
 4213eec74e74de6310c27a40c3e9759a08a73996
 openssh_8.1p1.orig.tar.gz
diff --git a/debian/changelog b/debian/changelog
index 1c08e2cbb..60660a0d3 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+openssh (1:8.1p1-5) UNRELEASED; urgency=medium
+
+  * Apply upstream patches to allow clock_nanosleep() and variants in the
+    seccomp sandbox, fixing failures with glibc 2.31.
+
+ -- Colin Watson <cjwatson@debian.org>  Sat, 11 Jan 2020 23:27:35 +0000
+
 openssh (1:8.1p1-4) unstable; urgency=medium
 
   * Apply upstream patch to stop using 2020 as a future date in regress
diff --git a/debian/patches/sandbox-seccomp-clock_gettime64.patch b/debian/patches/sandbox-seccomp-clock_gettime64.patch
new file mode 100644
index 000000000..ad0d647a2
--- /dev/null
+++ b/debian/patches/sandbox-seccomp-clock_gettime64.patch
@@ -0,0 +1,30 @@
+From 93e9440bae1818746e0cc7f2543001db9d0ea1ea Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Tue, 7 Jan 2020 16:26:45 -0800
+Subject: seccomp: Allow clock_gettime64() in sandbox.
+
+This helps sshd accept connections on mips platforms with
+upcoming glibc ( 2.31 )
+
+Origin: upstream, https://anongit.mindrot.org/openssh.git/commit/?id=b110cefdfbf5a20f49b774a55062d6ded2fb6e22
+Last-Update: 2020-01-11
+
+Patch-Name: sandbox-seccomp-clock_gettime64.patch
+---
+ sandbox-seccomp-filter.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
+index 3ef30c9d5..999c46c9f 100644
+--- a/sandbox-seccomp-filter.c
++++ b/sandbox-seccomp-filter.c
+@@ -248,6 +248,9 @@ static const struct sock_filter preauth_insns[] = {
+ #ifdef __NR_clock_nanosleep_time64
+        SC_ALLOW(__NR_clock_nanosleep_time64),
+ #endif
++#ifdef __NR_clock_gettime64
++       SC_ALLOW(__NR_clock_gettime64),
++#endif
+ #ifdef __NR__newselect
+        SC_ALLOW(__NR__newselect),
+ #endif
diff --git a/debian/patches/sandbox-seccomp-clock_nanosleep.patch b/debian/patches/sandbox-seccomp-clock_nanosleep.patch
new file mode 100644
index 000000000..ccf9d0b09
--- /dev/null
+++ b/debian/patches/sandbox-seccomp-clock_nanosleep.patch
@@ -0,0 +1,31 @@
+From c80d266f4aed7224261b192b8e31ac87dc070cba Mon Sep 17 00:00:00 2001
+From: Darren Tucker <dtucker@dtucker.net>
+Date: Wed, 13 Nov 2019 23:19:35 +1100
+Subject: seccomp: Allow clock_nanosleep() in sandbox.
+
+seccomp: Allow clock_nanosleep() to make OpenSSH working with latest
+glibc.  Patch from Jakub Jelen <jjelen@redhat.com> via bz #3093.
+
+Origin: upstream, https://anongit.mindrot.org/openssh.git/commit/?id=b1c82f4b8adf3f42476d8a1f292df33fb7aa1a56
+Origin: upstream, https://anongit.mindrot.org/openssh.git/commit/?id=546274a6f89489d2e6be8a8b62f2bb63c87a61fd
+Last-Update: 2020-01-11
+
+Patch-Name: sandbox-seccomp-clock_nanosleep.patch
+---
+ sandbox-seccomp-filter.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
+index b5cda70bb..be2397671 100644
+--- a/sandbox-seccomp-filter.c
++++ b/sandbox-seccomp-filter.c
+@@ -242,6 +242,9 @@ static const struct sock_filter preauth_insns[] = {
+ #ifdef __NR_nanosleep
+        SC_ALLOW(__NR_nanosleep),
+ #endif
++#ifdef __NR_clock_nanosleep
++       SC_ALLOW(__NR_clock_nanosleep),
++#endif
+ #ifdef __NR__newselect
+        SC_ALLOW(__NR__newselect),
+ #endif
diff --git a/debian/patches/sandbox-seccomp-clock_nanosleep_time64.patch b/debian/patches/sandbox-seccomp-clock_nanosleep_time64.patch
new file mode 100644
index 000000000..8825d569d
--- /dev/null
+++ b/debian/patches/sandbox-seccomp-clock_nanosleep_time64.patch
@@ -0,0 +1,29 @@
+From c80c5e338c19964755f277b54b390016f5c829a4 Mon Sep 17 00:00:00 2001
+From: Darren Tucker <dtucker@dtucker.net>
+Date: Mon, 16 Dec 2019 13:55:56 +1100
+Subject: Allow clock_nanosleep_time64 in seccomp sandbox.
+
+Needed on Linux ARM.  bz#3100, patch from jjelen@redhat.com.
+
+Origin: upstream, https://anongit.mindrot.org/openssh.git/commit/?id=5af6fd5461bb709304e6979c8b7856c7af921c9e
+Last-Update: 2020-01-11
+
+Patch-Name: sandbox-seccomp-clock_nanosleep_time64.patch
+---
+ sandbox-seccomp-filter.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
+index be2397671..3ef30c9d5 100644
+--- a/sandbox-seccomp-filter.c
++++ b/sandbox-seccomp-filter.c
+@@ -245,6 +245,9 @@ static const struct sock_filter preauth_insns[] = {
+ #ifdef __NR_clock_nanosleep
+        SC_ALLOW(__NR_clock_nanosleep),
+ #endif
++#ifdef __NR_clock_nanosleep_time64
++       SC_ALLOW(__NR_clock_nanosleep_time64),
++#endif
+ #ifdef __NR__newselect
+        SC_ALLOW(__NR__newselect),
+ #endif
diff --git a/debian/patches/series b/debian/patches/series
index 19a6569b8..8dbd1355a 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -24,3 +24,6 @@ restore-authorized_keys2.patch
 conch-old-privkey-format.patch
 revert-ipqos-defaults.patch
 regress-2020.patch
+sandbox-seccomp-clock_nanosleep.patch
+sandbox-seccomp-clock_nanosleep_time64.patch
+sandbox-seccomp-clock_gettime64.patch