diff options
author | Lonnie Abelbeck <lonnie@abelbeck.com> | 2019-10-01 09:05:09 -0500 |
---|---|---|
committer | Damien Miller <djm@mindrot.org> | 2019-10-02 12:24:38 +1000 |
commit | 3ef92a657444f172b61f92d5da66d94fa8265602 (patch) | |
tree | 87afe6bd278d2839d29e8c14e29b7aeebee93c8f /sandbox-seccomp-filter.c | |
parent | edd1d3a6261aecbf9a55944fd7be1db83571b46e (diff) |
Deny (non-fatal) shmget/shmat/shmdt in preauth privsep child.
New wait_random_seeded() function on OpenSSL 1.1.1d uses shmget, shmat, and shmdt
in the preauth codepath, deny (non-fatal) in seccomp_filter sandbox.
Diffstat (limited to 'sandbox-seccomp-filter.c')
-rw-r--r-- | sandbox-seccomp-filter.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c index 840c5232b..39dc289e3 100644 --- a/sandbox-seccomp-filter.c +++ b/sandbox-seccomp-filter.c | |||
@@ -168,6 +168,15 @@ static const struct sock_filter preauth_insns[] = { | |||
168 | #ifdef __NR_stat64 | 168 | #ifdef __NR_stat64 |
169 | SC_DENY(__NR_stat64, EACCES), | 169 | SC_DENY(__NR_stat64, EACCES), |
170 | #endif | 170 | #endif |
171 | #ifdef __NR_shmget | ||
172 | SC_DENY(__NR_shmget, EACCES), | ||
173 | #endif | ||
174 | #ifdef __NR_shmat | ||
175 | SC_DENY(__NR_shmat, EACCES), | ||
176 | #endif | ||
177 | #ifdef __NR_shmdt | ||
178 | SC_DENY(__NR_shmdt, EACCES), | ||
179 | #endif | ||
171 | 180 | ||
172 | /* Syscalls to permit */ | 181 | /* Syscalls to permit */ |
173 | #ifdef __NR_brk | 182 | #ifdef __NR_brk |