diff options
author | Khem Raj <raj.khem@gmail.com> | 2020-01-07 17:51:57 -0800 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2020-01-10 20:32:04 +0000 |
commit | 557d464de217cdf959aa275d20e7b155e4130ec7 (patch) | |
tree | 3dcf96d4aae7341130fa215879001b6ae99360d6 /meta/recipes-connectivity | |
parent | 993d6033fc11f698f328378d465889ff5d781aa0 (diff) | |
download | openembedded-core-contrib-557d464de217cdf959aa275d20e7b155e4130ec7.tar.gz |
openssh: Allow clock_nanosleep/clock_gettime64/clock_nanosleep_time64 syscall
Fixes connection denials with these syscalls being there on upcoming glibc 2.31 release
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-connectivity')
3 files changed, 60 insertions, 0 deletions
diff --git a/meta/recipes-connectivity/openssh/openssh/0001-seccomp-Allow-clock_gettime64-in-sandbox.patch b/meta/recipes-connectivity/openssh/openssh/0001-seccomp-Allow-clock_gettime64-in-sandbox.patch new file mode 100644 index 0000000000..78c493de86 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/0001-seccomp-Allow-clock_gettime64-in-sandbox.patch @@ -0,0 +1,31 @@ +From eae3e85322fa7c869f5822db4eda6348f2beb09e Mon Sep 17 00:00:00 2001 +From: Khem Raj <raj.khem@gmail.com> +Date: Tue, 7 Jan 2020 16:26:45 -0800 +Subject: [PATCH] seccomp: Allow clock_gettime64() in sandbox. + +This helps sshd accept connections on mips platforms with +upcoming glibc ( 2.31 ) + +Upstream-Status: Accepted [https://github.com/openssh/openssh-portable/pull/161] +Signed-off-by: Khem Raj <raj.khem@gmail.com> +--- + sandbox-seccomp-filter.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c +index 3ef30c9..999c46c 100644 +--- a/sandbox-seccomp-filter.c ++++ b/sandbox-seccomp-filter.c +@@ -248,6 +248,9 @@ static const struct sock_filter preauth_insns[] = { + #ifdef __NR_clock_nanosleep_time64 + SC_ALLOW(__NR_clock_nanosleep_time64), + #endif ++#ifdef __NR_clock_gettime64 ++ SC_ALLOW(__NR_clock_gettime64), ++#endif + #ifdef __NR__newselect + SC_ALLOW(__NR__newselect), + #endif +-- +2.24.1 + diff --git a/meta/recipes-connectivity/openssh/openssh/openssh-8.1p1-seccomp-nanosleep.patch b/meta/recipes-connectivity/openssh/openssh/openssh-8.1p1-seccomp-nanosleep.patch new file mode 100644 index 0000000000..7c9d61c26d --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/openssh-8.1p1-seccomp-nanosleep.patch @@ -0,0 +1,27 @@ +commit 7e929163ed40f9ce90060a3ca6df558c3d901379 +Author: Jakub Jelen <jjelen@redhat.com> +Date: Wed Nov 13 12:57:05 2019 +0100 + +seccomp: Allow clock_nanosleep() to make OpenSSH working with latest glibc +sandbox-seccomp: Allow clock_nanosleep on ARM + +Upstream-Status: Backport [https://github.com/tcely/openssh-portable/pull/258] + [https://github.com/bobby0809/openssh-portable/pull/138] + +Signed-off-by: Khem Raj <raj.khem@gmail.com + +--- a/sandbox-seccomp-filter.c ++++ b/sandbox-seccomp-filter.c +@@ -242,6 +242,12 @@ static const struct sock_filter preauth_ + #ifdef __NR_nanosleep + SC_ALLOW(__NR_nanosleep), + #endif ++#ifdef __NR_clock_nanosleep ++ SC_ALLOW(__NR_clock_nanosleep), ++#endif ++#ifdef __NR_clock_nanosleep_time64 ++ SC_ALLOW(__NR_clock_nanosleep_time64), ++#endif + #ifdef __NR__newselect + SC_ALLOW(__NR__newselect), + #endif diff --git a/meta/recipes-connectivity/openssh/openssh_8.1p1.bb b/meta/recipes-connectivity/openssh/openssh_8.1p1.bb index 024ebca402..f8be7ba178 100644 --- a/meta/recipes-connectivity/openssh/openssh_8.1p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_8.1p1.bb @@ -24,6 +24,8 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar file://fix-potential-signed-overflow-in-pointer-arithmatic.patch \ file://sshd_check_keys \ file://add-test-support-for-busybox.patch \ + file://openssh-8.1p1-seccomp-nanosleep.patch \ + file://0001-seccomp-Allow-clock_gettime64-in-sandbox.patch \ " SRC_URI[md5sum] = "513694343631a99841e815306806edf0" SRC_URI[sha256sum] = "02f5dbef3835d0753556f973cd57b4c19b6b1f6cd24c03445e23ac77ca1b93ff" |