RepoMirrors
/
openssh
mirror of git://anongit.mindrot.org/openssh.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
openssh/sandbox-seccomp-filter.c

529 lines
16 KiB
C
Raw Normal View History

- (djm) [Makefile.in configure.ac sandbox-seccomp-filter.c] Add sandbox mode for Linux's new seccomp filter; patch from Will Drewry; feedback and ok dtucker@
2012-04-04 01:27:54 +00:00
/*
* Copyright (c) 2012 Will Drewry <wad@dataspill.org>
harden Linux seccomp sandbox Linux mmap(2) and madvise(2) syscalls support quite a number of funky flags that we don't expect that sshd/libc will ever need. We can exclude this kernel attack surface by filtering the mmap(2) flags and the madvise(2) advice arguments. Similarly, the sandboxed process in sshd is a single-threaded program that does not use shared memory for synchronisation or communication. Therefore, there should be no reason for the advanced priority inheritance futex(2) operations to be necessary. These can also be excluded. Motivated by Jann Horn pointing out that there have been kernel bugs in nearby Linux kernel code, e.g. CVE-2020-29368, CVE-2020-29374 and CVE-2022-42703. Feedback Jann Horn, ok dtucker@
2023-02-03 05:33:09 +00:00
* Copyright (c) 2015,2017,2019,2020,2023 Damien Miller <djm@mindrot.org>
- (djm) [Makefile.in configure.ac sandbox-seccomp-filter.c] Add sandbox mode for Linux's new seccomp filter; patch from Will Drewry; feedback and ok dtucker@
2012-04-04 01:27:54 +00:00
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
/*
* Uncomment the SANDBOX_SECCOMP_FILTER_DEBUG macro below to help diagnose
* filter breakage during development. *Do not* use this in production,
* as it relies on making library calls that are unsafe in signal context.
*
* Instead, live systems the auditctl(8) may be used to monitor failures.
* E.g.
* auditctl -a task,always -F uid=<privsep uid>
*/
disable SANDBOX_SECCOMP_FILTER_DEBUG It was mistakenly enabled in 2580916e4872 Reported by Peter sec-openssh-com.22.fichtner AT 0sg.net
2022-12-07 07:38:25 +00:00
/* #define SANDBOX_SECCOMP_FILTER_DEBUG 1 */
- (djm) [sandbox-seccomp-filter.c] Soft-fail stat() syscalls. Add XXX to remind myself to add sandbox violation logging via the log socket.
2014-03-17 03:45:56 +00:00
fix SANDBOX_SECCOMP_FILTER_DEBUG
2022-08-10 22:58:28 +00:00
#if 0
/*
* For older toolchains, it may be necessary to use the kernel
* headers directly.
*/
- (djm) [Makefile.in configure.ac sandbox-seccomp-filter.c] Add sandbox mode for Linux's new seccomp filter; patch from Will Drewry; feedback and ok dtucker@
2012-04-04 01:27:54 +00:00
#ifdef SANDBOX_SECCOMP_FILTER_DEBUG
# include <asm/siginfo.h>
# define __have_siginfo_t 1
# define __have_sigval_t 1
# define __have_sigevent_t 1
#endif /* SANDBOX_SECCOMP_FILTER_DEBUG */
fix SANDBOX_SECCOMP_FILTER_DEBUG
2022-08-10 22:58:28 +00:00
#endif
- (djm) [Makefile.in configure.ac sandbox-seccomp-filter.c] Add sandbox mode for Linux's new seccomp filter; patch from Will Drewry; feedback and ok dtucker@
2012-04-04 01:27:54 +00:00
#include "includes.h"
#ifdef SANDBOX_SECCOMP_FILTER
#include <sys/types.h>
#include <sys/resource.h>
#include <sys/prctl.h>
allow mprotect(2) with PROT_(READ|WRITE|NONE) only Used by some hardened heap allocators. Requested by Yegor Timoshenko in https://github.com/openssh/openssh-portable/pull/142
2019-08-23 00:08:48 +00:00
#include <sys/mman.h>
Add sys/syscall.h for syscall numbers. In some architecture/libc configurations we need to explicitly include sys/syscall.h for the syscall number (__NR_xxx) definitions. bz#3085, patch from blowfist at xroutine.net.
2020-04-15 00:58:02 +00:00
#include <sys/syscall.h>
- (djm) [Makefile.in configure.ac sandbox-seccomp-filter.c] Add sandbox mode for Linux's new seccomp filter; patch from Will Drewry; feedback and ok dtucker@
2012-04-04 01:27:54 +00:00
harden Linux seccomp sandbox Linux mmap(2) and madvise(2) syscalls support quite a number of funky flags that we don't expect that sshd/libc will ever need. We can exclude this kernel attack surface by filtering the mmap(2) flags and the madvise(2) advice arguments. Similarly, the sandboxed process in sshd is a single-threaded program that does not use shared memory for synchronisation or communication. Therefore, there should be no reason for the advanced priority inheritance futex(2) operations to be necessary. These can also be excluded. Motivated by Jann Horn pointing out that there have been kernel bugs in nearby Linux kernel code, e.g. CVE-2020-29368, CVE-2020-29374 and CVE-2022-42703. Feedback Jann Horn, ok dtucker@
2023-02-03 05:33:09 +00:00
#include <linux/futex.h>
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#include <linux/net.h>
- (djm) [Makefile.in configure.ac sandbox-seccomp-filter.c] Add sandbox mode for Linux's new seccomp filter; patch from Will Drewry; feedback and ok dtucker@
2012-04-04 01:27:54 +00:00
#include <linux/audit.h>
#include <linux/filter.h>
#include <linux/seccomp.h>
- (djm) [configure.ac sandbox-seccomp-filter.c] Support for Linux seccomp-bpf sandbox on ARM. Patch from shawnlandden AT gmail.com; ok dtucker
2013-02-22 00:37:00 +00:00
#include <elf.h>
- (djm) [Makefile.in configure.ac sandbox-seccomp-filter.c] Add sandbox mode for Linux's new seccomp filter; patch from Will Drewry; feedback and ok dtucker@
2012-04-04 01:27:54 +00:00
#include <asm/unistd.h>
Missing header on Linux/s390 Patch from Jakub Jelen
2017-03-22 01:43:02 +00:00
#ifdef __s390__
#include <asm/zcrypt.h>
#endif
- (djm) [Makefile.in configure.ac sandbox-seccomp-filter.c] Add sandbox mode for Linux's new seccomp filter; patch from Will Drewry; feedback and ok dtucker@
2012-04-04 01:27:54 +00:00
#include <errno.h>
#include <signal.h>
#include <stdarg.h>
#include <stddef.h> /* for offsetof */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include "log.h"
#include "ssh-sandbox.h"
#include "xmalloc.h"
/* Linux seccomp_filter sandbox */
#define SECCOMP_FILTER_FAIL SECCOMP_RET_KILL
/* Use a signal handler to emit violations when debugging */
#ifdef SANDBOX_SECCOMP_FILTER_DEBUG
# undef SECCOMP_FILTER_FAIL
# define SECCOMP_FILTER_FAIL SECCOMP_RET_TRAP
#endif /* SANDBOX_SECCOMP_FILTER_DEBUG */
Fix weakness in seccomp-bpf sandbox arg inspection Syscall arguments are passed via an array of 64-bit values in struct seccomp_data, but we were only inspecting the bottom 32 bits and not even those correctly for BE systems. Fortunately, the only case argument inspection was used was in the socketcall filtering so using this for sandbox escape seems impossible. ok dtucker
2017-03-14 01:24:47 +00:00
#if __BYTE_ORDER == __LITTLE_ENDIAN
# define ARG_LO_OFFSET 0
# define ARG_HI_OFFSET sizeof(uint32_t)
#elif __BYTE_ORDER == __BIG_ENDIAN
# define ARG_LO_OFFSET sizeof(uint32_t)
# define ARG_HI_OFFSET 0
#else
#error "Unknown endianness"
#endif
- (djm) [Makefile.in configure.ac sandbox-seccomp-filter.c] Add sandbox mode for Linux's new seccomp filter; patch from Will Drewry; feedback and ok dtucker@
2012-04-04 01:27:54 +00:00
/* Simple helpers to avoid manual errors (but larger BPF programs). */
#define SC_DENY(_nr, _errno) \
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (_nr), 0, 1), \
- (djm) [Makefile.in configure.ac sandbox-seccomp-filter.c] Add sandbox mode for Linux's new seccomp filter; patch from Will Drewry; feedback and ok dtucker@
2012-04-04 01:27:54 +00:00
BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ERRNO|(_errno))
#define SC_ALLOW(_nr) \
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (_nr), 0, 1), \
- (djm) [Makefile.in configure.ac sandbox-seccomp-filter.c] Add sandbox mode for Linux's new seccomp filter; patch from Will Drewry; feedback and ok dtucker@
2012-04-04 01:27:54 +00:00
BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#define SC_ALLOW_ARG(_nr, _arg_nr, _arg_val) \
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (_nr), 0, 6), \
allow mprotect(2) with PROT_(READ|WRITE|NONE) only Used by some hardened heap allocators. Requested by Yegor Timoshenko in https://github.com/openssh/openssh-portable/pull/142
2019-08-23 00:08:48 +00:00
/* load and test syscall argument, low word */ \
Fix weakness in seccomp-bpf sandbox arg inspection Syscall arguments are passed via an array of 64-bit values in struct seccomp_data, but we were only inspecting the bottom 32 bits and not even those correctly for BE systems. Fortunately, the only case argument inspection was used was in the socketcall filtering so using this for sandbox escape seems impossible. ok dtucker
2017-03-14 01:24:47 +00:00
BPF_STMT(BPF_LD+BPF_W+BPF_ABS, \
offsetof(struct seccomp_data, args[(_arg_nr)]) + ARG_LO_OFFSET), \
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, \
((_arg_val) & 0xFFFFFFFF), 0, 3), \
allow mprotect(2) with PROT_(READ|WRITE|NONE) only Used by some hardened heap allocators. Requested by Yegor Timoshenko in https://github.com/openssh/openssh-portable/pull/142
2019-08-23 00:08:48 +00:00
/* load and test syscall argument, high word */ \
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
BPF_STMT(BPF_LD+BPF_W+BPF_ABS, \
Fix weakness in seccomp-bpf sandbox arg inspection Syscall arguments are passed via an array of 64-bit values in struct seccomp_data, but we were only inspecting the bottom 32 bits and not even those correctly for BE systems. Fortunately, the only case argument inspection was used was in the socketcall filtering so using this for sandbox escape seems impossible. ok dtucker
2017-03-14 01:24:47 +00:00
offsetof(struct seccomp_data, args[(_arg_nr)]) + ARG_HI_OFFSET), \
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, \
(((uint32_t)((uint64_t)(_arg_val) >> 32)) & 0xFFFFFFFF), 0, 1), \
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW), \
/* reload syscall number; all rules expect it in accumulator */ \
BPF_STMT(BPF_LD+BPF_W+BPF_ABS, \
offsetof(struct seccomp_data, nr))
allow mprotect(2) with PROT_(READ|WRITE|NONE) only Used by some hardened heap allocators. Requested by Yegor Timoshenko in https://github.com/openssh/openssh-portable/pull/142
2019-08-23 00:08:48 +00:00
/* Allow if syscall argument contains only values in mask */
#define SC_ALLOW_ARG_MASK(_nr, _arg_nr, _arg_mask) \
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (_nr), 0, 8), \
/* load, mask and test syscall argument, low word */ \
BPF_STMT(BPF_LD+BPF_W+BPF_ABS, \
offsetof(struct seccomp_data, args[(_arg_nr)]) + ARG_LO_OFFSET), \
BPF_STMT(BPF_ALU+BPF_AND+BPF_K, ~((_arg_mask) & 0xFFFFFFFF)), \
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0, 0, 4), \
/* load, mask and test syscall argument, high word */ \
BPF_STMT(BPF_LD+BPF_W+BPF_ABS, \
offsetof(struct seccomp_data, args[(_arg_nr)]) + ARG_HI_OFFSET), \
BPF_STMT(BPF_ALU+BPF_AND+BPF_K, \
~(((uint32_t)((uint64_t)(_arg_mask) >> 32)) & 0xFFFFFFFF)), \
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0, 0, 1), \
BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW), \
/* reload syscall number; all rules expect it in accumulator */ \
BPF_STMT(BPF_LD+BPF_W+BPF_ABS, \
offsetof(struct seccomp_data, nr))
harden Linux seccomp sandbox Linux mmap(2) and madvise(2) syscalls support quite a number of funky flags that we don't expect that sshd/libc will ever need. We can exclude this kernel attack surface by filtering the mmap(2) flags and the madvise(2) advice arguments. Similarly, the sandboxed process in sshd is a single-threaded program that does not use shared memory for synchronisation or communication. Therefore, there should be no reason for the advanced priority inheritance futex(2) operations to be necessary. These can also be excluded. Motivated by Jann Horn pointing out that there have been kernel bugs in nearby Linux kernel code, e.g. CVE-2020-29368, CVE-2020-29374 and CVE-2022-42703. Feedback Jann Horn, ok dtucker@
2023-02-03 05:33:09 +00:00
/* Deny unless syscall argument contains only values in mask */
#define SC_DENY_UNLESS_ARG_MASK(_nr, _arg_nr, _arg_mask, _errno) \
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (_nr), 0, 8), \
/* load, mask and test syscall argument, low word */ \
BPF_STMT(BPF_LD+BPF_W+BPF_ABS, \
offsetof(struct seccomp_data, args[(_arg_nr)]) + ARG_LO_OFFSET), \
BPF_STMT(BPF_ALU+BPF_AND+BPF_K, ~((_arg_mask) & 0xFFFFFFFF)), \
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0, 0, 3), \
/* load, mask and test syscall argument, high word */ \
BPF_STMT(BPF_LD+BPF_W+BPF_ABS, \
offsetof(struct seccomp_data, args[(_arg_nr)]) + ARG_HI_OFFSET), \
BPF_STMT(BPF_ALU+BPF_AND+BPF_K, \
~(((uint32_t)((uint64_t)(_arg_mask) >> 32)) & 0xFFFFFFFF)), \
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0, 1, 0), \
BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ERRNO|(_errno)), \
/* reload syscall number; all rules expect it in accumulator */ \
BPF_STMT(BPF_LD+BPF_W+BPF_ABS, \
offsetof(struct seccomp_data, nr))
#define SC_DENY_UNLESS_MASK(_nr, _arg_nr, _arg_val, _errno) \
/* Special handling for futex(2) that combines a bitmap and operation number */
#if defined(__NR_futex) || defined(__NR_futex_time64)
#define SC_FUTEX_MASK (FUTEX_PRIVATE_FLAG|FUTEX_CLOCK_REALTIME)
#define SC_ALLOW_FUTEX_OP(_nr, _op) \
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (_nr), 0, 8), \
/* load syscall argument, low word */ \
BPF_STMT(BPF_LD+BPF_W+BPF_ABS, \
offsetof(struct seccomp_data, args[1]) + ARG_LO_OFFSET), \
/* mask off allowed bitmap values, low word */ \
BPF_STMT(BPF_ALU+BPF_AND+BPF_K, ~(SC_FUTEX_MASK & 0xFFFFFFFF)), \
/* test operation number, low word */ \
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ((_op) & 0xFFFFFFFF), 0, 4), \
/* load syscall argument, high word */ \
BPF_STMT(BPF_LD+BPF_W+BPF_ABS, \
offsetof(struct seccomp_data, args[1]) + ARG_HI_OFFSET), \
/* mask off allowed bitmap values, high word */ \
BPF_STMT(BPF_ALU+BPF_AND+BPF_K, \
~(((uint32_t)((uint64_t)SC_FUTEX_MASK >> 32)) & 0xFFFFFFFF)), \
/* test operation number, high word */ \
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, \
(((uint32_t)((uint64_t)(_op) >> 32)) & 0xFFFFFFFF), 0, 1), \
BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW), \
/* reload syscall number; all rules expect it in accumulator */ \
BPF_STMT(BPF_LD+BPF_W+BPF_ABS, offsetof(struct seccomp_data, nr))
/* Use this for both __NR_futex and __NR_futex_time64 */
# define SC_FUTEX(_nr) \
SC_ALLOW_FUTEX_OP(__NR_futex, FUTEX_WAIT), \
SC_ALLOW_FUTEX_OP(__NR_futex, FUTEX_WAIT_BITSET), \
SC_ALLOW_FUTEX_OP(__NR_futex, FUTEX_WAKE), \
SC_ALLOW_FUTEX_OP(__NR_futex, FUTEX_WAKE_BITSET), \
SC_ALLOW_FUTEX_OP(__NR_futex, FUTEX_REQUEUE), \
SC_ALLOW_FUTEX_OP(__NR_futex, FUTEX_CMP_REQUEUE)
#endif /* __NR_futex || __NR_futex_time64 */
#if defined(__NR_mmap) || defined(__NR_mmap2)
Improve seccomp compat on older systems. Check if flags to mmap and madvise are defined before using them. Should fix problems building on older Linux systems that don't have these. bz#3537, with & ok djm@.
2023-02-11 01:32:19 +00:00
# ifdef MAP_FIXED_NOREPLACE
# define SC_MMAP_FLAGS MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED|MAP_FIXED_NOREPLACE
# else
# define SC_MMAP_FLAGS MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED
# endif /* MAP_FIXED_NOREPLACE */
harden Linux seccomp sandbox Linux mmap(2) and madvise(2) syscalls support quite a number of funky flags that we don't expect that sshd/libc will ever need. We can exclude this kernel attack surface by filtering the mmap(2) flags and the madvise(2) advice arguments. Similarly, the sandboxed process in sshd is a single-threaded program that does not use shared memory for synchronisation or communication. Therefore, there should be no reason for the advanced priority inheritance futex(2) operations to be necessary. These can also be excluded. Motivated by Jann Horn pointing out that there have been kernel bugs in nearby Linux kernel code, e.g. CVE-2020-29368, CVE-2020-29374 and CVE-2022-42703. Feedback Jann Horn, ok dtucker@
2023-02-03 05:33:09 +00:00
/* Use this for both __NR_mmap and __NR_mmap2 variants */
# define SC_MMAP(_nr) \
Improve seccomp compat on older systems. Check if flags to mmap and madvise are defined before using them. Should fix problems building on older Linux systems that don't have these. bz#3537, with & ok djm@.
2023-02-11 01:32:19 +00:00
SC_DENY_UNLESS_ARG_MASK(_nr, 3, SC_MMAP_FLAGS, EINVAL), \
harden Linux seccomp sandbox Linux mmap(2) and madvise(2) syscalls support quite a number of funky flags that we don't expect that sshd/libc will ever need. We can exclude this kernel attack surface by filtering the mmap(2) flags and the madvise(2) advice arguments. Similarly, the sandboxed process in sshd is a single-threaded program that does not use shared memory for synchronisation or communication. Therefore, there should be no reason for the advanced priority inheritance futex(2) operations to be necessary. These can also be excluded. Motivated by Jann Horn pointing out that there have been kernel bugs in nearby Linux kernel code, e.g. CVE-2020-29368, CVE-2020-29374 and CVE-2022-42703. Feedback Jann Horn, ok dtucker@
2023-02-03 05:33:09 +00:00
SC_ALLOW_ARG_MASK(_nr, 2, PROT_READ|PROT_WRITE|PROT_NONE)
#endif /* __NR_mmap || __NR_mmap2 */
- (djm) [Makefile.in configure.ac sandbox-seccomp-filter.c] Add sandbox mode for Linux's new seccomp filter; patch from Will Drewry; feedback and ok dtucker@
2012-04-04 01:27:54 +00:00
/* Syscall filtering set for preauth. */
static const struct sock_filter preauth_insns[] = {
/* Ensure the syscall arch convention is as expected. */
BPF_STMT(BPF_LD+BPF_W+BPF_ABS,
offsetof(struct seccomp_data, arch)),
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SECCOMP_AUDIT_ARCH, 1, 0),
BPF_STMT(BPF_RET+BPF_K, SECCOMP_FILTER_FAIL),
/* Load the syscall number for checking. */
BPF_STMT(BPF_LD+BPF_W+BPF_ABS,
offsetof(struct seccomp_data, nr)),
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
/* Syscalls to non-fatally deny */
Deny lstat syscalls in seccomp sandbox Avoids sandbox violations for some krb/gssapi libraries.
2016-05-19 23:56:53 +00:00
#ifdef __NR_lstat
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
SC_DENY(__NR_lstat, EACCES),
Deny lstat syscalls in seccomp sandbox Avoids sandbox violations for some krb/gssapi libraries.
2016-05-19 23:56:53 +00:00
#endif
#ifdef __NR_lstat64
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
SC_DENY(__NR_lstat64, EACCES),
Deny lstat syscalls in seccomp sandbox Avoids sandbox violations for some krb/gssapi libraries.
2016-05-19 23:56:53 +00:00
#endif
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#ifdef __NR_fstat
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
SC_DENY(__NR_fstat, EACCES),
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#endif
#ifdef __NR_fstat64
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
SC_DENY(__NR_fstat64, EACCES),
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#endif
Allow (but return EACCES) fstatat64 in sandbox. This is apparently used in some configurations of OpenSSL when glibc has getrandom(). bz#3276, patch from Kris Karas, ok djm@
2021-03-12 04:58:57 +00:00
#ifdef __NR_fstatat64
SC_DENY(__NR_fstatat64, EACCES),
#endif
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#ifdef __NR_open
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
SC_DENY(__NR_open, EACCES),
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#endif
#ifdef __NR_openat
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
SC_DENY(__NR_openat, EACCES),
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#endif
#ifdef __NR_newfstatat
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
SC_DENY(__NR_newfstatat, EACCES),
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#endif
#ifdef __NR_stat
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
SC_DENY(__NR_stat, EACCES),
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#endif
#ifdef __NR_stat64
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
SC_DENY(__NR_stat64, EACCES),
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#endif
Deny (non-fatal) shmget/shmat/shmdt in preauth privsep child. New wait_random_seeded() function on OpenSSL 1.1.1d uses shmget, shmat, and shmdt in the preauth codepath, deny (non-fatal) in seccomp_filter sandbox.
2019-10-01 14:05:09 +00:00
#ifdef __NR_shmget
SC_DENY(__NR_shmget, EACCES),
#endif
#ifdef __NR_shmat
SC_DENY(__NR_shmat, EACCES),
#endif
#ifdef __NR_shmdt
SC_DENY(__NR_shmdt, EACCES),
#endif
Deny (non-fatal) ipc in preauth privsep child. As noted in openssh/openssh-portable#149, i386 does not have have _NR_shmget etc. Instead, it has a single ipc syscall (see man 2 ipc, https://linux.die.net/man/2/ipc). Add this syscall, if present, to the list of syscalls that seccomp will deny non-fatally.
2019-10-12 01:31:05 +00:00
#ifdef __NR_ipc
SC_DENY(__NR_ipc, EACCES),
#endif
Deny (non-fatal) statx in preauth privsep child.
2020-11-08 13:19:23 +00:00
#ifdef __NR_statx
SC_DENY(__NR_statx, EACCES),
#endif
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
/* Syscalls to permit */
#ifdef __NR_brk
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
SC_ALLOW(__NR_brk),
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#endif
#ifdef __NR_clock_gettime
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
SC_ALLOW(__NR_clock_gettime),
- (djm) [configure.ac sandbox-seccomp-filter.c] Support for Linux seccomp-bpf sandbox on ARM. Patch from shawnlandden AT gmail.com; ok dtucker
2013-02-22 00:37:00 +00:00
#endif
add clock_gettime64(2) to sandbox allowed syscalls bz3093
2020-02-03 08:40:12 +00:00
#ifdef __NR_clock_gettime64
SC_ALLOW(__NR_clock_gettime64),
#endif
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#ifdef __NR_close
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
SC_ALLOW(__NR_close),
- (djm) [sandbox-seccomp-filter.c] Not all Linux architectures define __NR_shutdown; some go via the socketcall(2) multiplexer.
2014-02-06 00:17:50 +00:00
#endif
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#ifdef __NR_exit
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
SC_ALLOW(__NR_exit),
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#endif
#ifdef __NR_exit_group
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
SC_ALLOW(__NR_exit_group),
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#endif
add futex(2) syscall to seccomp sandbox Apparently needed for some glibc/openssl combinations. Patch from Arkadiusz Miśkiewicz
2018-09-15 09:37:48 +00:00
#ifdef __NR_futex
harden Linux seccomp sandbox Linux mmap(2) and madvise(2) syscalls support quite a number of funky flags that we don't expect that sshd/libc will ever need. We can exclude this kernel attack surface by filtering the mmap(2) flags and the madvise(2) advice arguments. Similarly, the sandboxed process in sshd is a single-threaded program that does not use shared memory for synchronisation or communication. Therefore, there should be no reason for the advanced priority inheritance futex(2) operations to be necessary. These can also be excluded. Motivated by Jann Horn pointing out that there have been kernel bugs in nearby Linux kernel code, e.g. CVE-2020-29368, CVE-2020-29374 and CVE-2022-42703. Feedback Jann Horn, ok dtucker@
2023-02-03 05:33:09 +00:00
SC_FUTEX(__NR_futex),
add futex(2) syscall to seccomp sandbox Apparently needed for some glibc/openssl combinations. Patch from Arkadiusz Miśkiewicz
2018-09-15 09:37:48 +00:00
#endif
Add __NR_futex_time64 to seccomp sandbox. This is apparently needed for (some) 32 bit platforms with glibc 2.33. Patch from nix at esperi.org.uk and jjelen at redhat.com via bz#3260.
2021-02-10 23:18:05 +00:00
#ifdef __NR_futex_time64
harden Linux seccomp sandbox Linux mmap(2) and madvise(2) syscalls support quite a number of funky flags that we don't expect that sshd/libc will ever need. We can exclude this kernel attack surface by filtering the mmap(2) flags and the madvise(2) advice arguments. Similarly, the sandboxed process in sshd is a single-threaded program that does not use shared memory for synchronisation or communication. Therefore, there should be no reason for the advanced priority inheritance futex(2) operations to be necessary. These can also be excluded. Motivated by Jann Horn pointing out that there have been kernel bugs in nearby Linux kernel code, e.g. CVE-2020-29368, CVE-2020-29374 and CVE-2022-42703. Feedback Jann Horn, ok dtucker@
2023-02-03 05:33:09 +00:00
SC_FUTEX(__NR_futex_time64),
Add __NR_futex_time64 to seccomp sandbox. This is apparently needed for (some) 32 bit platforms with glibc 2.33. Patch from nix at esperi.org.uk and jjelen at redhat.com via bz#3260.
2021-02-10 23:18:05 +00:00
#endif
Permit getuid()/geteuid() syscalls. Requested for Linux/s390; patch from Eduardo Barretto via bz#2752; ok dtucker
2018-05-25 03:36:58 +00:00
#ifdef __NR_geteuid
SC_ALLOW(__NR_geteuid),
#endif
#ifdef __NR_geteuid32
SC_ALLOW(__NR_geteuid32),
#endif
upstream commit add getpid to sandbox, reachable by grace_alarm_handler reported by Jakub Jelen; bz#2419 Upstream-ID: d0da1117c16d4c223954995d35b0f47c8f684cd8
2015-06-29 22:35:12 +00:00
#ifdef __NR_getpgid
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
SC_ALLOW(__NR_getpgid),
upstream commit add getpid to sandbox, reachable by grace_alarm_handler reported by Jakub Jelen; bz#2419 Upstream-ID: d0da1117c16d4c223954995d35b0f47c8f684cd8
2015-06-29 22:35:12 +00:00
#endif
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#ifdef __NR_getpid
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
SC_ALLOW(__NR_getpid),
- (djm) [Makefile.in configure.ac sandbox-seccomp-filter.c] Add sandbox mode for Linux's new seccomp filter; patch from Will Drewry; feedback and ok dtucker@
2012-04-04 01:27:54 +00:00
#endif
allow getrandom syscall; from Felix von Leitner
2015-09-10 00:57:41 +00:00
#ifdef __NR_getrandom
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
SC_ALLOW(__NR_getrandom),
allow getrandom syscall; from Felix von Leitner
2015-09-10 00:57:41 +00:00
#endif
sandbox-seccomp-filter: allow gettid Some allocators (such as Scudo) use gettid while tracing allocations [1]. Allow gettid in preauth to prevent sshd from crashing with Scudo. [1]: https://github.com/llvm/llvm-project/blob/llvmorg-13.0.0/compiler-rt/lib/gwp_asan/common.cpp#L46
2022-01-30 22:13:36 +00:00
#ifdef __NR_gettid
SC_ALLOW(__NR_gettid),
#endif
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#ifdef __NR_gettimeofday
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
SC_ALLOW(__NR_gettimeofday),
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#endif
Permit getuid()/geteuid() syscalls. Requested for Linux/s390; patch from Eduardo Barretto via bz#2752; ok dtucker
2018-05-25 03:36:58 +00:00
#ifdef __NR_getuid
SC_ALLOW(__NR_getuid),
#endif
#ifdef __NR_getuid32
SC_ALLOW(__NR_getuid32),
#endif
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#ifdef __NR_madvise
harden Linux seccomp sandbox Linux mmap(2) and madvise(2) syscalls support quite a number of funky flags that we don't expect that sshd/libc will ever need. We can exclude this kernel attack surface by filtering the mmap(2) flags and the madvise(2) advice arguments. Similarly, the sandboxed process in sshd is a single-threaded program that does not use shared memory for synchronisation or communication. Therefore, there should be no reason for the advanced priority inheritance futex(2) operations to be necessary. These can also be excluded. Motivated by Jann Horn pointing out that there have been kernel bugs in nearby Linux kernel code, e.g. CVE-2020-29368, CVE-2020-29374 and CVE-2022-42703. Feedback Jann Horn, ok dtucker@
2023-02-03 05:33:09 +00:00
SC_ALLOW_ARG(__NR_madvise, 2, MADV_NORMAL),
Improve seccomp compat on older systems. Check if flags to mmap and madvise are defined before using them. Should fix problems building on older Linux systems that don't have these. bz#3537, with & ok djm@.
2023-02-11 01:32:19 +00:00
# ifdef MADV_FREE
harden Linux seccomp sandbox Linux mmap(2) and madvise(2) syscalls support quite a number of funky flags that we don't expect that sshd/libc will ever need. We can exclude this kernel attack surface by filtering the mmap(2) flags and the madvise(2) advice arguments. Similarly, the sandboxed process in sshd is a single-threaded program that does not use shared memory for synchronisation or communication. Therefore, there should be no reason for the advanced priority inheritance futex(2) operations to be necessary. These can also be excluded. Motivated by Jann Horn pointing out that there have been kernel bugs in nearby Linux kernel code, e.g. CVE-2020-29368, CVE-2020-29374 and CVE-2022-42703. Feedback Jann Horn, ok dtucker@
2023-02-03 05:33:09 +00:00
SC_ALLOW_ARG(__NR_madvise, 2, MADV_FREE),
Improve seccomp compat on older systems. Check if flags to mmap and madvise are defined before using them. Should fix problems building on older Linux systems that don't have these. bz#3537, with & ok djm@.
2023-02-11 01:32:19 +00:00
# endif
# ifdef MADV_DONTNEED
harden Linux seccomp sandbox Linux mmap(2) and madvise(2) syscalls support quite a number of funky flags that we don't expect that sshd/libc will ever need. We can exclude this kernel attack surface by filtering the mmap(2) flags and the madvise(2) advice arguments. Similarly, the sandboxed process in sshd is a single-threaded program that does not use shared memory for synchronisation or communication. Therefore, there should be no reason for the advanced priority inheritance futex(2) operations to be necessary. These can also be excluded. Motivated by Jann Horn pointing out that there have been kernel bugs in nearby Linux kernel code, e.g. CVE-2020-29368, CVE-2020-29374 and CVE-2022-42703. Feedback Jann Horn, ok dtucker@
2023-02-03 05:33:09 +00:00
SC_ALLOW_ARG(__NR_madvise, 2, MADV_DONTNEED),
Improve seccomp compat on older systems. Check if flags to mmap and madvise are defined before using them. Should fix problems building on older Linux systems that don't have these. bz#3537, with & ok djm@.
2023-02-11 01:32:19 +00:00
# endif
# ifdef MADV_DONTFORK
harden Linux seccomp sandbox Linux mmap(2) and madvise(2) syscalls support quite a number of funky flags that we don't expect that sshd/libc will ever need. We can exclude this kernel attack surface by filtering the mmap(2) flags and the madvise(2) advice arguments. Similarly, the sandboxed process in sshd is a single-threaded program that does not use shared memory for synchronisation or communication. Therefore, there should be no reason for the advanced priority inheritance futex(2) operations to be necessary. These can also be excluded. Motivated by Jann Horn pointing out that there have been kernel bugs in nearby Linux kernel code, e.g. CVE-2020-29368, CVE-2020-29374 and CVE-2022-42703. Feedback Jann Horn, ok dtucker@
2023-02-03 05:33:09 +00:00
SC_ALLOW_ARG(__NR_madvise, 2, MADV_DONTFORK),
Improve seccomp compat on older systems. Check if flags to mmap and madvise are defined before using them. Should fix problems building on older Linux systems that don't have these. bz#3537, with & ok djm@.
2023-02-11 01:32:19 +00:00
# endif
# ifdef MADV_DONTDUMP
harden Linux seccomp sandbox Linux mmap(2) and madvise(2) syscalls support quite a number of funky flags that we don't expect that sshd/libc will ever need. We can exclude this kernel attack surface by filtering the mmap(2) flags and the madvise(2) advice arguments. Similarly, the sandboxed process in sshd is a single-threaded program that does not use shared memory for synchronisation or communication. Therefore, there should be no reason for the advanced priority inheritance futex(2) operations to be necessary. These can also be excluded. Motivated by Jann Horn pointing out that there have been kernel bugs in nearby Linux kernel code, e.g. CVE-2020-29368, CVE-2020-29374 and CVE-2022-42703. Feedback Jann Horn, ok dtucker@
2023-02-03 05:33:09 +00:00
SC_ALLOW_ARG(__NR_madvise, 2, MADV_DONTDUMP),
Improve seccomp compat on older systems. Check if flags to mmap and madvise are defined before using them. Should fix problems building on older Linux systems that don't have these. bz#3537, with & ok djm@.
2023-02-11 01:32:19 +00:00
# endif
# ifdef MADV_WIPEONFORK
harden Linux seccomp sandbox Linux mmap(2) and madvise(2) syscalls support quite a number of funky flags that we don't expect that sshd/libc will ever need. We can exclude this kernel attack surface by filtering the mmap(2) flags and the madvise(2) advice arguments. Similarly, the sandboxed process in sshd is a single-threaded program that does not use shared memory for synchronisation or communication. Therefore, there should be no reason for the advanced priority inheritance futex(2) operations to be necessary. These can also be excluded. Motivated by Jann Horn pointing out that there have been kernel bugs in nearby Linux kernel code, e.g. CVE-2020-29368, CVE-2020-29374 and CVE-2022-42703. Feedback Jann Horn, ok dtucker@
2023-02-03 05:33:09 +00:00
SC_ALLOW_ARG(__NR_madvise, 2, MADV_WIPEONFORK),
Improve seccomp compat on older systems. Check if flags to mmap and madvise are defined before using them. Should fix problems building on older Linux systems that don't have these. bz#3537, with & ok djm@.
2023-02-11 01:32:19 +00:00
# endif
harden Linux seccomp sandbox Linux mmap(2) and madvise(2) syscalls support quite a number of funky flags that we don't expect that sshd/libc will ever need. We can exclude this kernel attack surface by filtering the mmap(2) flags and the madvise(2) advice arguments. Similarly, the sandboxed process in sshd is a single-threaded program that does not use shared memory for synchronisation or communication. Therefore, there should be no reason for the advanced priority inheritance futex(2) operations to be necessary. These can also be excluded. Motivated by Jann Horn pointing out that there have been kernel bugs in nearby Linux kernel code, e.g. CVE-2020-29368, CVE-2020-29374 and CVE-2022-42703. Feedback Jann Horn, ok dtucker@
2023-02-03 05:33:09 +00:00
SC_DENY(__NR_madvise, EINVAL),
- (djm) [configure.ac sandbox-seccomp-filter.c] Support for Linux seccomp-bpf sandbox on ARM. Patch from shawnlandden AT gmail.com; ok dtucker
2013-02-22 00:37:00 +00:00
#endif
#ifdef __NR_mmap
harden Linux seccomp sandbox Linux mmap(2) and madvise(2) syscalls support quite a number of funky flags that we don't expect that sshd/libc will ever need. We can exclude this kernel attack surface by filtering the mmap(2) flags and the madvise(2) advice arguments. Similarly, the sandboxed process in sshd is a single-threaded program that does not use shared memory for synchronisation or communication. Therefore, there should be no reason for the advanced priority inheritance futex(2) operations to be necessary. These can also be excluded. Motivated by Jann Horn pointing out that there have been kernel bugs in nearby Linux kernel code, e.g. CVE-2020-29368, CVE-2020-29374 and CVE-2022-42703. Feedback Jann Horn, ok dtucker@
2023-02-03 05:33:09 +00:00
SC_MMAP(__NR_mmap),
- (djm) [sandbox-seccomp-filter.c] Allow mremap and exit for DietLibc; patch from Felix von Leitner; ok dtucker
2014-09-09 22:15:34 +00:00
#endif
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#ifdef __NR_mmap2
harden Linux seccomp sandbox Linux mmap(2) and madvise(2) syscalls support quite a number of funky flags that we don't expect that sshd/libc will ever need. We can exclude this kernel attack surface by filtering the mmap(2) flags and the madvise(2) advice arguments. Similarly, the sandboxed process in sshd is a single-threaded program that does not use shared memory for synchronisation or communication. Therefore, there should be no reason for the advanced priority inheritance futex(2) operations to be necessary. These can also be excluded. Motivated by Jann Horn pointing out that there have been kernel bugs in nearby Linux kernel code, e.g. CVE-2020-29368, CVE-2020-29374 and CVE-2022-42703. Feedback Jann Horn, ok dtucker@
2023-02-03 05:33:09 +00:00
SC_MMAP(__NR_mmap2),
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#endif
allow mprotect(2) with PROT_(READ|WRITE|NONE) only Used by some hardened heap allocators. Requested by Yegor Timoshenko in https://github.com/openssh/openssh-portable/pull/142
2019-08-23 00:08:48 +00:00
#ifdef __NR_mprotect
SC_ALLOW_ARG_MASK(__NR_mprotect, 2, PROT_READ|PROT_WRITE|PROT_NONE),
#endif
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#ifdef __NR_mremap
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
SC_ALLOW(__NR_mremap),
- (djm) [configure.ac sandbox-seccomp-filter.c] Support for Linux seccomp-bpf sandbox on ARM. Patch from shawnlandden AT gmail.com; ok dtucker
2013-02-22 00:37:00 +00:00
#endif
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#ifdef __NR_munmap
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
SC_ALLOW(__NR_munmap),
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#endif
Allow nanosleep in preauth privsep child. The new timing attack mitigation code uses nanosleep in the preauth codepath, allow in sandbox.
2018-04-13 06:06:29 +00:00
#ifdef __NR_nanosleep
SC_ALLOW(__NR_nanosleep),
#endif
seccomp: Allow clock_nanosleep() in sandbox. seccomp: Allow clock_nanosleep() to make OpenSSH working with latest glibc. Patch from Jakub Jelen <jjelen@redhat.com> via bz #3093.
2019-11-13 12:19:35 +00:00
#ifdef __NR_clock_nanosleep
SC_ALLOW(__NR_clock_nanosleep),
#endif
Allow clock_nanosleep_time64 in seccomp sandbox. Needed on Linux ARM. bz#3100, patch from jjelen@redhat.com.
2019-12-16 02:55:56 +00:00
#ifdef __NR_clock_nanosleep_time64
SC_ALLOW(__NR_clock_nanosleep_time64),
#endif
seccomp: Allow clock_gettime64() in sandbox. This helps sshd accept connections on mips platforms with upcoming glibc ( 2.31 )
2020-01-08 00:26:45 +00:00
#ifdef __NR_clock_gettime64
SC_ALLOW(__NR_clock_gettime64),
#endif
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#ifdef __NR__newselect
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
SC_ALLOW(__NR__newselect),
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#endif
adjust seccomp filter for select->poll conversion Needed to add ppoll syscall but also to relax the fallback rlimit sandbox. Linux poll() fails with EINVAL if npfds > RLIMIT_NOFILE, so we have to allow a single fd in the rlimit.
2021-11-17 23:16:55 +00:00
#ifdef __NR_ppoll
SC_ALLOW(__NR_ppoll),
#endif
Allow ppoll_time64 in seccomp sandbox. Should fix sandbox violations on (some? at least i386 and armhf) 32bit Linux platforms. Patch from chutzpahu at gentoo.org and cjwatson at debian.org via bz#3396.
2022-02-26 03:06:14 +00:00
#ifdef __NR_ppoll_time64
SC_ALLOW(__NR_ppoll_time64),
#endif
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#ifdef __NR_poll
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
SC_ALLOW(__NR_poll),
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#endif
add missing pselect6 patch from Jakub Jelen
2015-06-24 23:51:39 +00:00
#ifdef __NR_pselect6
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
SC_ALLOW(__NR_pselect6),
add missing pselect6 patch from Jakub Jelen
2015-06-24 23:51:39 +00:00
#endif
Add new pselect6_time64 syscall on ARM. This is apparently needed on armhfp/armv7hl. bz#3232, patch from jjelen at redhat.com.
2020-11-20 02:37:54 +00:00
#ifdef __NR_pselect6_time64
SC_ALLOW(__NR_pselect6_time64),
#endif
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#ifdef __NR_read
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
SC_ALLOW(__NR_read),
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#endif
- (djm) [Makefile.in configure.ac sandbox-seccomp-filter.c] Add sandbox mode for Linux's new seccomp filter; patch from Will Drewry; feedback and ok dtucker@
2012-04-04 01:27:54 +00:00
#ifdef __NR_rt_sigprocmask
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
SC_ALLOW(__NR_rt_sigprocmask),
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#endif
#ifdef __NR_select
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
SC_ALLOW(__NR_select),
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#endif
#ifdef __NR_shutdown
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
SC_ALLOW(__NR_shutdown),
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#endif
#ifdef __NR_sigprocmask
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
SC_ALLOW(__NR_sigprocmask),
- (djm) [Makefile.in configure.ac sandbox-seccomp-filter.c] Add sandbox mode for Linux's new seccomp filter; patch from Will Drewry; feedback and ok dtucker@
2012-04-04 01:27:54 +00:00
#endif
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#ifdef __NR_time
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
SC_ALLOW(__NR_time),
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#endif
#ifdef __NR_write
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
SC_ALLOW(__NR_write),
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#endif
Allow writev is seccomp sandbox. This seems to be used by recent glibcs at least in some configurations. From bz#3512, ok djm@
2023-01-14 11:02:44 +00:00
#ifdef __NR_writev
SC_ALLOW(__NR_writev),
#endif
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#ifdef __NR_socketcall
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
SC_ALLOW_ARG(__NR_socketcall, 0, SYS_SHUTDOWN),
Fix typo in "socketcall". Pointed out by jjelen at redhat.com.
2017-04-24 22:32:27 +00:00
SC_DENY(__NR_socketcall, EACCES),
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
#endif
support ioctls for ICA crypto card on Linux/s390 Based on patch from Eduardo Barretto; ok dtucker@
2017-03-14 02:15:18 +00:00
#if defined(__NR_ioctl) && defined(__s390__)
/* Allow ioctls for ICA crypto card on s390 */
Remove macro trickery; no binary change This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
2017-03-14 06:48:43 +00:00
SC_ALLOW_ARG(__NR_ioctl, 1, Z90STAT_STATUS_MASK),
SC_ALLOW_ARG(__NR_ioctl, 1, ICARSAMODEXPO),
SC_ALLOW_ARG(__NR_ioctl, 1, ICARSACRT),
allow s390 specific ioctl for ecc hardware support Adding another s390 specific ioctl to be able to support ECC hardware acceleration to the sandbox seccomp filter rules. Now the ibmca openssl engine provides elliptic curve cryptography support with the help of libica and CCA crypto cards. This is done via jet another ioctl call to the zcrypt device driver and so there is a need to enable this on the openssl sandbox. Code is s390 specific and has been tested, verified and reviewed. Please note that I am also the originator of the previous changes in that area. I posted these changes to Eduardo and he forwarded the patches to the openssl community. Signed-off-by: Harald Freudenberger <freude@linux.ibm.com> Reviewed-by: Joerg Schmidbauer <jschmidb@de.ibm.com>
2019-05-24 08:11:15 +00:00
SC_ALLOW_ARG(__NR_ioctl, 1, ZSECSENDCPRB),
Enable specific ioctl call for EP11 crypto card (s390) The EP11 crypto card needs to make an ioctl call, which receives an specific argument. This crypto card is for s390 only. Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
2017-05-09 16:33:30 +00:00
/* Allow ioctls for EP11 crypto card on s390 */
SC_ALLOW_ARG(__NR_ioctl, 1, ZSENDEP11CPRB),
Make seccomp-bpf sandbox work on Linux/X32 Allow clock_gettime syscall with X32 bit masked off. Apparently this is required for at least some kernel versions. bz#2142 Patch mostly by Colin Watson. ok dtucker@
2017-03-14 07:26:29 +00:00
#endif
#if defined(__x86_64__) && defined(__ILP32__) && defined(__X32_SYSCALL_BIT)
/*
* On Linux x32, the clock_gettime VDSO falls back to the
* x86-64 syscall under some circumstances, e.g.
* https://bugs.debian.org/849923
*/
Fix syntax error on Linux/X32 Patch from Mike Frysinger
2017-03-20 21:47:55 +00:00
SC_ALLOW(__NR_clock_gettime & ~__X32_SYSCALL_BIT),
Make seccomp-bpf sandbox work on Linux/X32 Allow clock_gettime syscall with X32 bit masked off. Apparently this is required for at least some kernel versions. bz#2142 Patch mostly by Colin Watson. ok dtucker@
2017-03-14 07:26:29 +00:00
#endif
aarch64 support for seccomp-bpf sandbox Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
2015-06-17 00:50:51 +00:00
/* Default deny */
- (djm) [Makefile.in configure.ac sandbox-seccomp-filter.c] Add sandbox mode for Linux's new seccomp filter; patch from Will Drewry; feedback and ok dtucker@
2012-04-04 01:27:54 +00:00
BPF_STMT(BPF_RET+BPF_K, SECCOMP_FILTER_FAIL),
};
static const struct sock_fprog preauth_program = {
.len = (unsigned short)(sizeof(preauth_insns)/sizeof(preauth_insns[0])),
.filter = (struct sock_filter *)preauth_insns,
};
struct ssh_sandbox {
upstream: Split per-connection sshd-session binary This splits the user authentication code from the sshd-session binary into a separate sshd-auth binary. This will be executed by sshd-session to complete the user authentication phase of the protocol only. Splitting this code into a separate binary ensures that the crucial pre-authentication attack surface has an entirely disjoint address space from the code used for the rest of the connection. It also yields a small runtime memory saving as the authentication code will be unloaded after thhe authentication phase completes. Joint work with markus@ feedback deraadt@ Tested in snaps since last week OpenBSD-Commit-ID: 9c3b2087ae08626ec31b4177b023db600e986d9c
2024-10-14 01:57:50 +00:00
int junk;
- (djm) [Makefile.in configure.ac sandbox-seccomp-filter.c] Add sandbox mode for Linux's new seccomp filter; patch from Will Drewry; feedback and ok dtucker@
2012-04-04 01:27:54 +00:00
};
struct ssh_sandbox *
- (djm) [Makefile.in configure.ac sandbox-capsicum.c sandbox-darwin.c] [sandbox-null.c sandbox-rlimit.c sandbox-seccomp-filter.c] [sandbox-systrace.c ssh-sandbox.h sshd.c] Support preauth sandboxing using the Capsicum API introduced in FreeBSD 10. Patch by Dag-Erling Smorgrav, updated by Loganaden Velvindron @ AfriNIC; ok dtucker@
2014-01-17 05:47:04 +00:00
ssh_sandbox_init(struct monitor *monitor)
- (djm) [Makefile.in configure.ac sandbox-seccomp-filter.c] Add sandbox mode for Linux's new seccomp filter; patch from Will Drewry; feedback and ok dtucker@
2012-04-04 01:27:54 +00:00
{
struct ssh_sandbox *box;
/*
* Strictly, we don't need to maintain any state here but we need
* to return non-NULL to satisfy the API.
*/
debug3("%s: preparing seccomp filter sandbox", __func__);
box = xcalloc(1, sizeof(*box));
return box;
}
#ifdef SANDBOX_SECCOMP_FILTER_DEBUG
extern struct monitor *pmonitor;
fix SANDBOX_SECCOMP_FILTER_DEBUG
2022-08-10 22:58:28 +00:00
void mm_log_handler(LogLevel level, int forced, const char *msg, void *ctx);
- (djm) [Makefile.in configure.ac sandbox-seccomp-filter.c] Add sandbox mode for Linux's new seccomp filter; patch from Will Drewry; feedback and ok dtucker@
2012-04-04 01:27:54 +00:00
static void
ssh_sandbox_violation(int signum, siginfo_t *info, void *void_context)
{
char msg[256];
snprintf(msg, sizeof(msg),
"%s: unexpected system call (arch:0x%x,syscall:%d @ %p)",
__func__, info->si_arch, info->si_syscall, info->si_call_addr);
fix SANDBOX_SECCOMP_FILTER_DEBUG
2022-08-10 22:58:28 +00:00
mm_log_handler(SYSLOG_LEVEL_FATAL, 0, msg, pmonitor);
- (djm) [Makefile.in configure.ac sandbox-seccomp-filter.c] Add sandbox mode for Linux's new seccomp filter; patch from Will Drewry; feedback and ok dtucker@
2012-04-04 01:27:54 +00:00
_exit(1);
}
static void
ssh_sandbox_child_debugging(void)
{
struct sigaction act;
sigset_t mask;
debug3("%s: installing SIGSYS handler", __func__);
memset(&act, 0, sizeof(act));
sigemptyset(&mask);
sigaddset(&mask, SIGSYS);
act.sa_sigaction = &ssh_sandbox_violation;
act.sa_flags = SA_SIGINFO;
if (sigaction(SIGSYS, &act, NULL) == -1)
fatal("%s: sigaction(SIGSYS): %s", __func__, strerror(errno));
if (sigprocmask(SIG_UNBLOCK, &mask, NULL) == -1)
fatal("%s: sigprocmask(SIGSYS): %s",
polish whitespace for portable files
2021-04-03 06:47:37 +00:00
__func__, strerror(errno));
- (djm) [Makefile.in configure.ac sandbox-seccomp-filter.c] Add sandbox mode for Linux's new seccomp filter; patch from Will Drewry; feedback and ok dtucker@
2012-04-04 01:27:54 +00:00
}
#endif /* SANDBOX_SECCOMP_FILTER_DEBUG */
void
ssh_sandbox_child(struct ssh_sandbox *box)
{
adjust seccomp filter for select->poll conversion Needed to add ppoll syscall but also to relax the fallback rlimit sandbox. Linux poll() fails with EINVAL if npfds > RLIMIT_NOFILE, so we have to allow a single fd in the rlimit.
2021-11-17 23:16:55 +00:00
struct rlimit rl_zero, rl_one = {.rlim_cur = 1, .rlim_max = 1};
- (djm) [sandbox-seccomp-filter.c] fallback to rlimit if seccomp filter is not available. Allows use of sshd compiled on host with a filter-capable kernel on hosts that lack the support. bz#2011 ok dtucker@
2012-07-06 00:27:10 +00:00
int nnp_failed = 0;
- (djm) [Makefile.in configure.ac sandbox-seccomp-filter.c] Add sandbox mode for Linux's new seccomp filter; patch from Will Drewry; feedback and ok dtucker@
2012-04-04 01:27:54 +00:00
/* Set rlimits for completeness if possible. */
rl_zero.rlim_cur = rl_zero.rlim_max = 0;
if (setrlimit(RLIMIT_FSIZE, &rl_zero) == -1)
fatal("%s: setrlimit(RLIMIT_FSIZE, { 0, 0 }): %s",
__func__, strerror(errno));
adjust seccomp filter for select->poll conversion Needed to add ppoll syscall but also to relax the fallback rlimit sandbox. Linux poll() fails with EINVAL if npfds > RLIMIT_NOFILE, so we have to allow a single fd in the rlimit.
2021-11-17 23:16:55 +00:00
/*
* Cannot use zero for nfds, because poll(2) will fail with
* errno=EINVAL if npfds>RLIMIT_NOFILE.
*/
if (setrlimit(RLIMIT_NOFILE, &rl_one) == -1)
- (djm) [Makefile.in configure.ac sandbox-seccomp-filter.c] Add sandbox mode for Linux's new seccomp filter; patch from Will Drewry; feedback and ok dtucker@
2012-04-04 01:27:54 +00:00
fatal("%s: setrlimit(RLIMIT_NOFILE, { 0, 0 }): %s",
__func__, strerror(errno));
if (setrlimit(RLIMIT_NPROC, &rl_zero) == -1)
fatal("%s: setrlimit(RLIMIT_NPROC, { 0, 0 }): %s",
__func__, strerror(errno));
#ifdef SANDBOX_SECCOMP_FILTER_DEBUG
ssh_sandbox_child_debugging();
#endif /* SANDBOX_SECCOMP_FILTER_DEBUG */
debug3("%s: setting PR_SET_NO_NEW_PRIVS", __func__);
- (djm) [sandbox-seccomp-filter.c] fallback to rlimit if seccomp filter is not available. Allows use of sshd compiled on host with a filter-capable kernel on hosts that lack the support. bz#2011 ok dtucker@
2012-07-06 00:27:10 +00:00
if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1) {
debug("%s: prctl(PR_SET_NO_NEW_PRIVS): %s",
polish whitespace for portable files
2021-04-03 06:47:37 +00:00
__func__, strerror(errno));
- (djm) [sandbox-seccomp-filter.c] fallback to rlimit if seccomp filter is not available. Allows use of sshd compiled on host with a filter-capable kernel on hosts that lack the support. bz#2011 ok dtucker@
2012-07-06 00:27:10 +00:00
nnp_failed = 1;
}
- (djm) [Makefile.in configure.ac sandbox-seccomp-filter.c] Add sandbox mode for Linux's new seccomp filter; patch from Will Drewry; feedback and ok dtucker@
2012-04-04 01:27:54 +00:00
debug3("%s: attaching seccomp filter program", __func__);
if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &preauth_program) == -1)
- (djm) [sandbox-seccomp-filter.c] fallback to rlimit if seccomp filter is not available. Allows use of sshd compiled on host with a filter-capable kernel on hosts that lack the support. bz#2011 ok dtucker@
2012-07-06 00:27:10 +00:00
debug("%s: prctl(PR_SET_SECCOMP): %s",
polish whitespace for portable files
2021-04-03 06:47:37 +00:00
__func__, strerror(errno));
- (djm) [sandbox-seccomp-filter.c] fallback to rlimit if seccomp filter is not available. Allows use of sshd compiled on host with a filter-capable kernel on hosts that lack the support. bz#2011 ok dtucker@
2012-07-06 00:27:10 +00:00
else if (nnp_failed)
fatal("%s: SECCOMP_MODE_FILTER activated but "
"PR_SET_NO_NEW_PRIVS failed", __func__);
- (djm) [Makefile.in configure.ac sandbox-seccomp-filter.c] Add sandbox mode for Linux's new seccomp filter; patch from Will Drewry; feedback and ok dtucker@
2012-04-04 01:27:54 +00:00
}
#endif /* SANDBOX_SECCOMP_FILTER */