5 files changed, 55 insertions, 2 deletions

diff --git a/debian/.git-dpm b/debian/.git-dpm
index a00414acf..6b01a8e76 100644
--- a/debian/.git-dpm
+++ b/debian/.git-dpm
@@ -1,6 +1,6 @@
 # see git-dpm(1) from git-dpm package
-61d2706623ed144ee9cbd212d13eeba202a7ce26
-61d2706623ed144ee9cbd212d13eeba202a7ce26
+ceefaa8ee80b63c0890d24c42369dc51880f53ea
+ceefaa8ee80b63c0890d24c42369dc51880f53ea
 102062f825fb26a74295a1c089c00c4c4c76b68a
 102062f825fb26a74295a1c089c00c4c4c76b68a
 openssh_8.0p1.orig.tar.gz
diff --git a/debian/changelog b/debian/changelog
index bae206cf9..4577011ee 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -3,6 +3,11 @@ openssh (1:8.0p1-7) UNRELEASED; urgency=medium
   [ Daniel Kahn Gillmor ]
   * runit: Correct typo in comment.
 
+  [ Colin Watson ]
+  * Apply upstream patch to deny (non-fatally) shmget/shmat/shmdt in preauth
+    privsep child, coping with changes in OpenSSL 1.1.1d that broke OpenSSH
+    on Linux kernels before 3.19 (closes: #941663).
+
  -- Colin Watson <cjwatson@debian.org>  Wed, 28 Aug 2019 21:19:41 +0100
 
 openssh (1:8.0p1-6) unstable; urgency=medium
diff --git a/debian/patches/seccomp-handle-shm.patch b/debian/patches/seccomp-handle-shm.patch
new file mode 100644
index 000000000..7ad068190
--- /dev/null
+++ b/debian/patches/seccomp-handle-shm.patch
@@ -0,0 +1,38 @@
+From ceefaa8ee80b63c0890d24c42369dc51880f53ea Mon Sep 17 00:00:00 2001
+From: Lonnie Abelbeck <lonnie@abelbeck.com>
+Date: Tue, 1 Oct 2019 09:05:09 -0500
+Subject: Deny (non-fatal) shmget/shmat/shmdt in preauth privsep child.
+
+New wait_random_seeded() function on OpenSSL 1.1.1d uses shmget, shmat, and shmdt
+in the preauth codepath, deny (non-fatal) in seccomp_filter sandbox.
+
+Bug: https://github.com/openssh/openssh-portable/pull/149
+Bug-Debian: https://bugs.debian.org/941663
+Origin: upstream, https://anongit.mindrot.org/openssh.git/commit/?id=3ef92a657444f172b61f92d5da66d94fa8265602
+Last-Update: 2019-10-05
+
+Patch-Name: seccomp-handle-shm.patch
+---
+ sandbox-seccomp-filter.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
+index ef4de8c65..e8f31555e 100644
+--- a/sandbox-seccomp-filter.c
++++ b/sandbox-seccomp-filter.c
+@@ -149,6 +149,15 @@ static const struct sock_filter preauth_insns[] = {
+ #ifdef __NR_stat64
+        SC_DENY(__NR_stat64, EACCES),
+ #endif
++#ifdef __NR_shmget
++       SC_DENY(__NR_shmget, EACCES),
++#endif
++#ifdef __NR_shmat
++       SC_DENY(__NR_shmat, EACCES),
++#endif
++#ifdef __NR_shmdt
++       SC_DENY(__NR_shmdt, EACCES),
++#endif
+ 
+        /* Syscalls to permit */
+ #ifdef __NR_brk
diff --git a/debian/patches/series b/debian/patches/series
index 7ca779801..4af8d8861 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -27,3 +27,4 @@ fix-interop-tests.patch
 conch-old-privkey-format.patch
 revert-ipqos-defaults.patch
 fix-utimensat-test.patch
+seccomp-handle-shm.patch
diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
index ef4de8c65..e8f31555e 100644
--- a/sandbox-seccomp-filter.c
+++ b/sandbox-seccomp-filter.c
@@ -149,6 +149,15 @@ static const struct sock_filter preauth_insns[] = {
 #ifdef __NR_stat64
         SC_DENY(__NR_stat64, EACCES),
 #endif
+#ifdef __NR_shmget
+        SC_DENY(__NR_shmget, EACCES),
+#endif
+#ifdef __NR_shmat
+        SC_DENY(__NR_shmat, EACCES),
+#endif
+#ifdef __NR_shmdt
+        SC_DENY(__NR_shmdt, EACCES),
+#endif
 
         /* Syscalls to permit */
 #ifdef __NR_brk