diff options
Diffstat (limited to 'debian/patches/sandbox-x32-workaround.patch')
-rw-r--r-- | debian/patches/sandbox-x32-workaround.patch | 37 |
1 files changed, 37 insertions, 0 deletions
diff --git a/debian/patches/sandbox-x32-workaround.patch b/debian/patches/sandbox-x32-workaround.patch new file mode 100644 index 000000000..340363de9 --- /dev/null +++ b/debian/patches/sandbox-x32-workaround.patch | |||
@@ -0,0 +1,37 @@ | |||
1 | From 8c1a0893f0e55a793071af9734d2fa2eb1f3a2a6 Mon Sep 17 00:00:00 2001 | ||
2 | From: Colin Watson <cjwatson@debian.org> | ||
3 | Date: Tue, 3 Jan 2017 14:01:56 +0000 | ||
4 | Subject: Work around clock_gettime kernel bug on Linux x32 | ||
5 | |||
6 | On Linux x32, the clock_gettime VDSO currently falls back to the x86-64 | ||
7 | syscall, so allow that as well as its x32 sibling. | ||
8 | |||
9 | Bug-Debian: https://bugs.debian.org/849923 | ||
10 | Forwarded: no | ||
11 | Last-Update: 2017-01-03 | ||
12 | |||
13 | Patch-Name: sandbox-x32-workaround.patch | ||
14 | --- | ||
15 | sandbox-seccomp-filter.c | 9 +++++++++ | ||
16 | 1 file changed, 9 insertions(+) | ||
17 | |||
18 | diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c | ||
19 | index 2e1ed2c5..62c578d3 100644 | ||
20 | --- a/sandbox-seccomp-filter.c | ||
21 | +++ b/sandbox-seccomp-filter.c | ||
22 | @@ -137,6 +137,15 @@ static const struct sock_filter preauth_insns[] = { | ||
23 | #endif | ||
24 | #ifdef __NR_clock_gettime | ||
25 | SC_ALLOW(clock_gettime), | ||
26 | +# if defined(__x86_64__) && defined(__ILP32__) | ||
27 | + /* On Linux x32, the clock_gettime VDSO currently falls back to the | ||
28 | + * x86-64 syscall (see https://bugs.debian.org/849923), so allow | ||
29 | + * that too. | ||
30 | + */ | ||
31 | + BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, | ||
32 | + __NR_clock_gettime & ~__X32_SYSCALL_BIT, 0, 1), | ||
33 | + BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW), | ||
34 | +# endif | ||
35 | #endif | ||
36 | #ifdef __NR_close | ||
37 | SC_ALLOW(close), | ||