diff options
| author | Lonnie Abelbeck <lonnie@abelbeck.com> | 2019-10-01 16:05:09 +0200 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2019-10-02 04:24:38 +0200 |
| commit | 3ef92a657444f172b61f92d5da66d94fa8265602 (patch) | |
| tree | 87afe6bd278d2839d29e8c14e29b7aeebee93c8f /sandbox-seccomp-filter.c | |
| parent | remove duplicate #includes (diff) | |
| download | openssh-3ef92a657444f172b61f92d5da66d94fa8265602.tar.xz openssh-3ef92a657444f172b61f92d5da66d94fa8265602.zip | |
Deny (non-fatal) shmget/shmat/shmdt in preauth privsep child.
New wait_random_seeded() function on OpenSSL 1.1.1d uses shmget, shmat, and shmdt
in the preauth codepath, deny (non-fatal) in seccomp_filter sandbox.
Diffstat (limited to 'sandbox-seccomp-filter.c')
| -rw-r--r-- | sandbox-seccomp-filter.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c index 840c5232b..39dc289e3 100644 --- a/sandbox-seccomp-filter.c +++ b/sandbox-seccomp-filter.c @@ -168,6 +168,15 @@ static const struct sock_filter preauth_insns[] = { #ifdef __NR_stat64 SC_DENY(__NR_stat64, EACCES), #endif +#ifdef __NR_shmget + SC_DENY(__NR_shmget, EACCES), +#endif +#ifdef __NR_shmat + SC_DENY(__NR_shmat, EACCES), +#endif +#ifdef __NR_shmdt + SC_DENY(__NR_shmdt, EACCES), +#endif /* Syscalls to permit */ #ifdef __NR_brk |