diff options
| author | Colin Watson <cjwatson@debian.org> | 2019-10-05 22:29:01 +0100 |
|---|---|---|
| committer | Colin Watson <cjwatson@debian.org> | 2019-10-05 22:30:21 +0100 |
| commit | 699f6971bc8a142016c60e712839a9722886522f (patch) | |
| tree | c2c1ade36e56d72b63d91cc4168eaa2b203b5c7b /sandbox-seccomp-filter.c | |
| parent | 07252689f247e0ea037027ebd17b09b33ce1f5b4 (diff) | |
| parent | ceefaa8ee80b63c0890d24c42369dc51880f53ea (diff) | |
Deny (non-fatal) shmget/shmat/shmdt in preauth privsep child
This copes with changes in OpenSSL 1.1.1d that broke OpenSSH on Linux
kernels before 3.19.
Closes: #941663
Diffstat (limited to 'sandbox-seccomp-filter.c')
| -rw-r--r-- | sandbox-seccomp-filter.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c index ef4de8c65..e8f31555e 100644 --- a/sandbox-seccomp-filter.c +++ b/sandbox-seccomp-filter.c | |||
| @@ -149,6 +149,15 @@ static const struct sock_filter preauth_insns[] = { | |||
| 149 | #ifdef __NR_stat64 | 149 | #ifdef __NR_stat64 |
| 150 | SC_DENY(__NR_stat64, EACCES), | 150 | SC_DENY(__NR_stat64, EACCES), |
| 151 | #endif | 151 | #endif |
| 152 | #ifdef __NR_shmget | ||
| 153 | SC_DENY(__NR_shmget, EACCES), | ||
| 154 | #endif | ||
| 155 | #ifdef __NR_shmat | ||
| 156 | SC_DENY(__NR_shmat, EACCES), | ||
| 157 | #endif | ||
| 158 | #ifdef __NR_shmdt | ||
| 159 | SC_DENY(__NR_shmdt, EACCES), | ||
| 160 | #endif | ||
| 152 | 161 | ||
| 153 | /* Syscalls to permit */ | 162 | /* Syscalls to permit */ |
| 154 | #ifdef __NR_brk | 163 | #ifdef __NR_brk |