9 files changed, 166 insertions, 17 deletions

diff --git a/debian/.git-dpm b/debian/.git-dpm
index 011e71d0a..c3f3645c9 100644
--- a/debian/.git-dpm
+++ b/debian/.git-dpm
@@ -1,6 +1,6 @@
 # see git-dpm(1) from git-dpm package
-cda04ac1f5c69710187e602043758063479c3c65
-cda04ac1f5c69710187e602043758063479c3c65
+375f99251da3754666750fe1ed63575ba909f397
+375f99251da3754666750fe1ed63575ba909f397
 6fabaf6fd9b07cc8bc6a17c9c4a5b76849cfc874
 6fabaf6fd9b07cc8bc6a17c9c4a5b76849cfc874
 openssh_7.5p1.orig.tar.gz
diff --git a/debian/changelog b/debian/changelog
index ab93af357..6cae8eb74 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -3,6 +3,8 @@ openssh (1:7.5p1-8) UNRELEASED; urgency=medium
   * Drop openssh-client-ssh1, now built by a separate source package.
   * Run haveged during autopkgtests to ensure that they have enough entropy
     for key generation (LP: #1712921).
+  * Apply patches from https://bugzilla.mindrot.org/show_bug.cgi?id=2752 to
+    allow some extra syscalls for crypto cards on s390x (LP: #1686618).
 
  -- Colin Watson <cjwatson@debian.org>  Sun, 27 Aug 2017 23:24:58 +0100
 
diff --git a/debian/patches/auth-log-verbosity.patch b/debian/patches/auth-log-verbosity.patch
index 6b5653ca7..fb3855f9a 100644
--- a/debian/patches/auth-log-verbosity.patch
+++ b/debian/patches/auth-log-verbosity.patch
@@ -18,7 +18,7 @@ diff --git a/auth-options.c b/auth-options.c
 index 57b49f7f..7eb87b35 100644
 --- a/auth-options.c
 +++ b/auth-options.c
-@@ -59,9 +59,20 @@ int forced_tun_device = -1;
+@@ -59,8 +59,19 @@ int forced_tun_device = -1;
  /* "principals=" option. */
  char *authorized_principals = NULL;
  
@@ -28,17 +28,16 @@ index 57b49f7f..7eb87b35 100644
 +
  extern ServerOptions options;
  
- void
++void
 +auth_start_parse_options(void)
 +{
 +       logged_from_hostip = 0;
 +       logged_cert_hostip = 0;
 +}
 +
-+void
+ void
  auth_clear_options(void)
  {
-        no_agent_forwarding_flag = 0;
 @@ -316,10 +327,13 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
                                 /* FALLTHROUGH */
                         case 0:
diff --git a/debian/patches/gssapi.patch b/debian/patches/gssapi.patch
index c74926dc6..deddbcb80 100644
--- a/debian/patches/gssapi.patch
+++ b/debian/patches/gssapi.patch
@@ -266,10 +266,11 @@ index 6ee6116d..c6390687 100644
                         return 1;
                 break;
         case PERMIT_FORCED_ONLY:
-@@ -795,99 +796,6 @@ fakepw(void)
+@@ -794,99 +795,6 @@ fakepw(void)
+        return (&fake);
  }
  
- /*
+-/*
 - * Returns the remote DNS hostname as a string. The returned string must not
 - * be freed. NB. this will usually trigger a DNS query the first time it is
 - * called.
@@ -362,10 +363,9 @@ index 6ee6116d..c6390687 100644
 -       return strdup(name);
 -}
 -
--/*
+ /*
   * Return the canonical name of the host in the other side of the current
   * connection.  The host name is cached, so it is efficient to call this
-  * several times.
 diff --git a/auth2-gss.c b/auth2-gss.c
 index 1ca83577..3b5036df 100644
 --- a/auth2-gss.c
@@ -875,10 +875,11 @@ index 62559ed9..0b3ae073 100644
             GSS_C_MUTUAL_FLAG | GSS_C_INTEG_FLAG | deleg_flag,
             0, NULL, recv_tok, NULL, send_tok, flags, NULL);
  
-@@ -228,8 +383,42 @@ ssh_gssapi_import_name(Gssctxt *ctx, const char *host)
+@@ -227,9 +382,43 @@ ssh_gssapi_import_name(Gssctxt *ctx, const char *host)
+        return (ctx->major);
  }
  
- OM_uint32
++OM_uint32
 +ssh_gssapi_client_identity(Gssctxt *ctx, const char *name)
 +{
 +       gss_buffer_desc gssbuf;
@@ -909,7 +910,7 @@ index 62559ed9..0b3ae073 100644
 +       return(ctx->major);
 +}
 +
-+OM_uint32
+ OM_uint32
  ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_t buffer, gss_buffer_t hash)
  {
 +       if (ctx == NULL) 
@@ -1199,10 +1200,11 @@ index 53993d67..2e27cbf9 100644
  
  #ifdef KRB5
  extern ssh_gssapi_mech gssapi_kerberos_mech;
-@@ -142,6 +147,28 @@ ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID oid)
+@@ -141,6 +146,28 @@ ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID oid)
+        return (ssh_gssapi_acquire_cred(*ctx));
  }
  
- /* Unprivileged */
++/* Unprivileged */
 +char *
 +ssh_gssapi_server_mechanisms(void) {
 +       if (supported_oids == NULL)
@@ -1224,10 +1226,9 @@ index 53993d67..2e27cbf9 100644
 +       return (res);
 +}
 +
-+/* Unprivileged */
+ /* Unprivileged */
  void
  ssh_gssapi_supported_oids(gss_OID_set *oidset)
- {
 @@ -151,7 +178,9 @@ ssh_gssapi_supported_oids(gss_OID_set *oidset)
         gss_OID_set supported;
  
diff --git a/debian/patches/seccomp-getuid-geteuid.patch b/debian/patches/seccomp-getuid-geteuid.patch
new file mode 100644
index 000000000..c829abaa9
--- /dev/null
+++ b/debian/patches/seccomp-getuid-geteuid.patch
@@ -0,0 +1,44 @@
+From b2195f2116754f99fff8ceae026931be3aa3cd3b Mon Sep 17 00:00:00 2001
+From: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
+Date: Tue, 9 May 2017 13:31:05 -0300
+Subject: Allow getuid and geteuid calls
+
+getuid and geteuid are needed when using an openssl engine that calls a
+crypto card, e.g. ICA (libica).
+Those syscalls are also needed by the distros for audit code.
+
+Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
+
+Origin: other, https://bugzilla.mindrot.org/show_bug.cgi?id=2752
+Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2752
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1686618
+Last-Update: 2017-08-28
+
+Patch-Name: seccomp-getuid-geteuid.patch
+---
+ sandbox-seccomp-filter.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
+index 997b66ff..4cbaaa2e 100644
+--- a/sandbox-seccomp-filter.c
++++ b/sandbox-seccomp-filter.c
+@@ -175,6 +175,18 @@ static const struct sock_filter preauth_insns[] = {
+ #ifdef __NR_getpid
+        SC_ALLOW(__NR_getpid),
+ #endif
++#ifdef __NR_getuid
++       SC_ALLOW(__NR_getuid),
++#endif
++#ifdef __NR_getuid32
++       SC_ALLOW(__NR_getuid32),
++#endif
++#ifdef __NR_geteuid
++       SC_ALLOW(__NR_geteuid),
++#endif
++#ifdef __NR_geteuid32
++       SC_ALLOW(__NR_geteuid32),
++#endif
+ #ifdef __NR_getrandom
+        SC_ALLOW(__NR_getrandom),
+ #endif
diff --git a/debian/patches/seccomp-s390-flock-ipc.patch b/debian/patches/seccomp-s390-flock-ipc.patch
new file mode 100644
index 000000000..7b5ed1098
--- /dev/null
+++ b/debian/patches/seccomp-s390-flock-ipc.patch
@@ -0,0 +1,47 @@
+From 057d62d148428cf0411cf37d00feb8741e5a424c Mon Sep 17 00:00:00 2001
+From: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
+Date: Tue, 9 May 2017 10:53:04 -0300
+Subject: Allow flock and ipc syscall for s390 architecture
+
+In order to use the OpenSSL-ibmpkcs11 engine it is needed to allow flock
+and ipc calls, because this engine calls OpenCryptoki (a PKCS#11
+implementation) which calls the libraries that will communicate with the
+crypto cards. OpenCryptoki makes use of flock and ipc and, as of now,
+this is only need on s390 architecture.
+
+Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
+
+Origin: other, https://bugzilla.mindrot.org/show_bug.cgi?id=2752
+Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2752
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1686618
+Last-Update: 2017-08-28
+
+Patch-Name: seccomp-s390-flock-ipc.patch
+---
+ sandbox-seccomp-filter.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
+index 2831e9d1..997b66ff 100644
+--- a/sandbox-seccomp-filter.c
++++ b/sandbox-seccomp-filter.c
+@@ -166,6 +166,9 @@ static const struct sock_filter preauth_insns[] = {
+ #ifdef __NR_exit_group
+        SC_ALLOW(__NR_exit_group),
+ #endif
++#if defined(__NR_flock) && defined(__s390__)
++       SC_ALLOW(__NR_flock),
++#endif
+ #ifdef __NR_getpgid
+        SC_ALLOW(__NR_getpgid),
+ #endif
+@@ -178,6 +181,9 @@ static const struct sock_filter preauth_insns[] = {
+ #ifdef __NR_gettimeofday
+        SC_ALLOW(__NR_gettimeofday),
+ #endif
++#if defined(__NR_ipc) && defined(__s390__)
++       SC_ALLOW(__NR_ipc),
++#endif
+ #ifdef __NR_madvise
+        SC_ALLOW(__NR_madvise),
+ #endif
diff --git a/debian/patches/seccomp-s390-ioctl-ep11-crypto.patch b/debian/patches/seccomp-s390-ioctl-ep11-crypto.patch
new file mode 100644
index 000000000..83997695e
--- /dev/null
+++ b/debian/patches/seccomp-s390-ioctl-ep11-crypto.patch
@@ -0,0 +1,33 @@
+From 375f99251da3754666750fe1ed63575ba909f397 Mon Sep 17 00:00:00 2001
+From: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
+Date: Tue, 9 May 2017 13:33:30 -0300
+Subject: Enable specific ioctl call for EP11 crypto card (s390)
+
+The EP11 crypto card needs to make an ioctl call, which receives an
+specific argument. This crypto card is for s390 only.
+
+Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
+
+Origin: other, https://bugzilla.mindrot.org/show_bug.cgi?id=2752
+Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2752
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1686618
+Last-Update: 2017-08-28
+
+Patch-Name: seccomp-s390-ioctl-ep11-crypto.patch
+---
+ sandbox-seccomp-filter.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
+index 4cbaaa2e..3833424b 100644
+--- a/sandbox-seccomp-filter.c
++++ b/sandbox-seccomp-filter.c
+@@ -249,6 +249,8 @@ static const struct sock_filter preauth_insns[] = {
+        SC_ALLOW_ARG(__NR_ioctl, 1, Z90STAT_STATUS_MASK),
+        SC_ALLOW_ARG(__NR_ioctl, 1, ICARSAMODEXPO),
+        SC_ALLOW_ARG(__NR_ioctl, 1, ICARSACRT),
++       /* Allow ioctls for EP11 crypto card on s390 */
++       SC_ALLOW_ARG(__NR_ioctl, 1, ZSENDEP11CPRB),
+ #endif
+ #if defined(__x86_64__) && defined(__ILP32__) && defined(__X32_SYSCALL_BIT)
+        /*
diff --git a/debian/patches/series b/debian/patches/series
index a46f3a408..c9d79be6a 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -28,3 +28,6 @@ restore-authorized_keys2.patch
 s390-missing-header.patch
 x32-syntax-error.patch
 fix-incoming-compression-statistics.patch
+seccomp-s390-flock-ipc.patch
+seccomp-getuid-geteuid.patch
+seccomp-s390-ioctl-ep11-crypto.patch
diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
index 2831e9d10..3833424bf 100644
--- a/sandbox-seccomp-filter.c
+++ b/sandbox-seccomp-filter.c
@@ -166,18 +166,36 @@ static const struct sock_filter preauth_insns[] = {
 #ifdef __NR_exit_group
         SC_ALLOW(__NR_exit_group),
 #endif
+#if defined(__NR_flock) && defined(__s390__)
+        SC_ALLOW(__NR_flock),
+#endif
 #ifdef __NR_getpgid
         SC_ALLOW(__NR_getpgid),
 #endif
 #ifdef __NR_getpid
         SC_ALLOW(__NR_getpid),
 #endif
+#ifdef __NR_getuid
+        SC_ALLOW(__NR_getuid),
+#endif
+#ifdef __NR_getuid32
+        SC_ALLOW(__NR_getuid32),
+#endif
+#ifdef __NR_geteuid
+        SC_ALLOW(__NR_geteuid),
+#endif
+#ifdef __NR_geteuid32
+        SC_ALLOW(__NR_geteuid32),
+#endif
 #ifdef __NR_getrandom
         SC_ALLOW(__NR_getrandom),
 #endif
 #ifdef __NR_gettimeofday
         SC_ALLOW(__NR_gettimeofday),
 #endif
+#if defined(__NR_ipc) && defined(__s390__)
+        SC_ALLOW(__NR_ipc),
+#endif
 #ifdef __NR_madvise
         SC_ALLOW(__NR_madvise),
 #endif
@@ -231,6 +249,8 @@ static const struct sock_filter preauth_insns[] = {
         SC_ALLOW_ARG(__NR_ioctl, 1, Z90STAT_STATUS_MASK),
         SC_ALLOW_ARG(__NR_ioctl, 1, ICARSAMODEXPO),
         SC_ALLOW_ARG(__NR_ioctl, 1, ICARSACRT),
+        /* Allow ioctls for EP11 crypto card on s390 */
+        SC_ALLOW_ARG(__NR_ioctl, 1, ZSENDEP11CPRB),
 #endif
 #if defined(__x86_64__) && defined(__ILP32__) && defined(__X32_SYSCALL_BIT)
         /*