summaryrefslogtreecommitdiff
path: root/debian/patches/sandbox-x32-workaround.patch
diff options
context:
space:
mode:
Diffstat (limited to 'debian/patches/sandbox-x32-workaround.patch')
-rw-r--r--debian/patches/sandbox-x32-workaround.patch37
1 files changed, 37 insertions, 0 deletions
diff --git a/debian/patches/sandbox-x32-workaround.patch b/debian/patches/sandbox-x32-workaround.patch
new file mode 100644
index 000000000..340363de9
--- /dev/null
+++ b/debian/patches/sandbox-x32-workaround.patch
@@ -0,0 +1,37 @@
1From 8c1a0893f0e55a793071af9734d2fa2eb1f3a2a6 Mon Sep 17 00:00:00 2001
2From: Colin Watson <cjwatson@debian.org>
3Date: Tue, 3 Jan 2017 14:01:56 +0000
4Subject: Work around clock_gettime kernel bug on Linux x32
5
6On Linux x32, the clock_gettime VDSO currently falls back to the x86-64
7syscall, so allow that as well as its x32 sibling.
8
9Bug-Debian: https://bugs.debian.org/849923
10Forwarded: no
11Last-Update: 2017-01-03
12
13Patch-Name: sandbox-x32-workaround.patch
14---
15 sandbox-seccomp-filter.c | 9 +++++++++
16 1 file changed, 9 insertions(+)
17
18diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
19index 2e1ed2c5..62c578d3 100644
20--- a/sandbox-seccomp-filter.c
21+++ b/sandbox-seccomp-filter.c
22@@ -137,6 +137,15 @@ static const struct sock_filter preauth_insns[] = {
23 #endif
24 #ifdef __NR_clock_gettime
25 SC_ALLOW(clock_gettime),
26+# if defined(__x86_64__) && defined(__ILP32__)
27+ /* On Linux x32, the clock_gettime VDSO currently falls back to the
28+ * x86-64 syscall (see https://bugs.debian.org/849923), so allow
29+ * that too.
30+ */
31+ BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K,
32+ __NR_clock_gettime & ~__X32_SYSCALL_BIT, 0, 1),
33+ BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
34+# endif
35 #endif
36 #ifdef __NR_close
37 SC_ALLOW(close),