RepoMirrors/openssh
1
0
Fork 0
mirror of git://anongit.mindrot.org/openssh.git synced 2024-12-23 10:22:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

- matthew@cvs.openbsd.org 2014/06/18 02:59:13

Browse Source 
[sandbox-systrace.c]
     Now that we have a dedicated getentropy(2) system call for
     arc4random(3), we can disallow __sysctl(2) in OpenSSH's systrace
     sandbox.

     ok djm
This commit is contained in:
Damien Miller 2014-07-02 12:47:48 +10:00
parent 51504ceec6
commit 84a89161a9
2 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ChangeLog
View File

@ -4,6 +4,13 @@
[sandbox-systrace.c]
permit SYS_getentropy
from matthew
- matthew@cvs.openbsd.org 2014/06/18 02:59:13
[sandbox-systrace.c]
Now that we have a dedicated getentropy(2) system call for
arc4random(3), we can disallow __sysctl(2) in OpenSSH's systrace
sandbox.
ok djm
20140618
- (tim) [openssh/session.c] Work around to get chroot sftp working on UnixWare

10
sandbox-systrace.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: sandbox-systrace.c,v 1.10 2014/06/13 08:26:29 deraadt Exp $ */
/* $OpenBSD: sandbox-systrace.c,v 1.11 2014/06/18 02:59:13 matthew Exp $ */
/*
* Copyright (c) 2011 Damien Miller <djm@mindrot.org>
*
@ -52,11 +52,17 @@ struct sandbox_policy {
static const struct sandbox_policy preauth_policy[] = {
{ SYS_open, SYSTR_POLICY_NEVER },
#ifdef SYS_getentropy
/* OpenBSD 5.6 and newer use getentropy(2) to seed arc4random(3). */
{ SYS_getentropy, SYSTR_POLICY_PERMIT },
#else
/* Previous releases used sysctl(3)'s kern.arnd variable. */
{ SYS___sysctl, SYSTR_POLICY_PERMIT },
#endif
{ SYS_close, SYSTR_POLICY_PERMIT },
{ SYS_exit, SYSTR_POLICY_PERMIT },
{ SYS_getpid, SYSTR_POLICY_PERMIT },
{ SYS_getentropy, SYSTR_POLICY_PERMIT },
{ SYS_gettimeofday, SYSTR_POLICY_PERMIT },
{ SYS_clock_gettime, SYSTR_POLICY_PERMIT },
{ SYS_madvise, SYSTR_POLICY_PERMIT },