diff options
| author | Lonnie Abelbeck <lonnie@abelbeck.com> | 2019-10-01 09:05:09 -0500 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2019-10-02 12:24:38 +1000 |
| commit | 3ef92a657444f172b61f92d5da66d94fa8265602 (patch) | |
| tree | 87afe6bd278d2839d29e8c14e29b7aeebee93c8f | |
| parent | edd1d3a6261aecbf9a55944fd7be1db83571b46e (diff) | |
Deny (non-fatal) shmget/shmat/shmdt in preauth privsep child.
New wait_random_seeded() function on OpenSSL 1.1.1d uses shmget, shmat, and shmdt
in the preauth codepath, deny (non-fatal) in seccomp_filter sandbox.
| -rw-r--r-- | sandbox-seccomp-filter.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c index 840c5232..39dc289e 100644 --- a/sandbox-seccomp-filter.c +++ b/sandbox-seccomp-filter.c @@ -168,6 +168,15 @@ static const struct sock_filter preauth_insns[] = { #ifdef __NR_stat64 SC_DENY(__NR_stat64, EACCES), #endif +#ifdef __NR_shmget + SC_DENY(__NR_shmget, EACCES), +#endif +#ifdef __NR_shmat + SC_DENY(__NR_shmat, EACCES), +#endif +#ifdef __NR_shmdt + SC_DENY(__NR_shmdt, EACCES), +#endif /* Syscalls to permit */ #ifdef __NR_brk |