summaryrefslogtreecommitdiffstats
path: root/meta/recipes-connectivity/openssh
diff options
context:
space:
mode:
authorKhem Raj <raj.khem@gmail.com>2020-01-07 17:51:57 -0800
committerRichard Purdie <richard.purdie@linuxfoundation.org>2020-01-10 21:18:22 +0000
commitf6c25f546b7baf823b21ccb29db8854112aeebd5 (patch)
tree8ccc3547f6f4f1bff27adda25647a0cc8cb764ac /meta/recipes-connectivity/openssh
parentb3be0ff09ef86c50ee691726a263d6af09499aab (diff)
downloadpoky-f6c25f546b7baf823b21ccb29db8854112aeebd5.tar.gz
openssh: Allow clock_nanosleep/clock_gettime64/clock_nanosleep_time64 syscall
Fixes connection denials with these syscalls being there on upcoming glibc 2.31 release (From OE-Core rev: 557d464de217cdf959aa275d20e7b155e4130ec7) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-connectivity/openssh')
-rw-r--r--meta/recipes-connectivity/openssh/openssh/0001-seccomp-Allow-clock_gettime64-in-sandbox.patch31
-rw-r--r--meta/recipes-connectivity/openssh/openssh/openssh-8.1p1-seccomp-nanosleep.patch27
-rw-r--r--meta/recipes-connectivity/openssh/openssh_8.1p1.bb2
3 files changed, 60 insertions, 0 deletions
diff --git a/meta/recipes-connectivity/openssh/openssh/0001-seccomp-Allow-clock_gettime64-in-sandbox.patch b/meta/recipes-connectivity/openssh/openssh/0001-seccomp-Allow-clock_gettime64-in-sandbox.patch
new file mode 100644
index 0000000000..78c493de86
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/0001-seccomp-Allow-clock_gettime64-in-sandbox.patch
@@ -0,0 +1,31 @@
1From eae3e85322fa7c869f5822db4eda6348f2beb09e Mon Sep 17 00:00:00 2001
2From: Khem Raj <raj.khem@gmail.com>
3Date: Tue, 7 Jan 2020 16:26:45 -0800
4Subject: [PATCH] seccomp: Allow clock_gettime64() in sandbox.
5
6This helps sshd accept connections on mips platforms with
7upcoming glibc ( 2.31 )
8
9Upstream-Status: Accepted [https://github.com/openssh/openssh-portable/pull/161]
10Signed-off-by: Khem Raj <raj.khem@gmail.com>
11---
12 sandbox-seccomp-filter.c | 3 +++
13 1 file changed, 3 insertions(+)
14
15diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
16index 3ef30c9..999c46c 100644
17--- a/sandbox-seccomp-filter.c
18+++ b/sandbox-seccomp-filter.c
19@@ -248,6 +248,9 @@ static const struct sock_filter preauth_insns[] = {
20 #ifdef __NR_clock_nanosleep_time64
21 SC_ALLOW(__NR_clock_nanosleep_time64),
22 #endif
23+#ifdef __NR_clock_gettime64
24+ SC_ALLOW(__NR_clock_gettime64),
25+#endif
26 #ifdef __NR__newselect
27 SC_ALLOW(__NR__newselect),
28 #endif
29--
302.24.1
31
diff --git a/meta/recipes-connectivity/openssh/openssh/openssh-8.1p1-seccomp-nanosleep.patch b/meta/recipes-connectivity/openssh/openssh/openssh-8.1p1-seccomp-nanosleep.patch
new file mode 100644
index 0000000000..7c9d61c26d
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/openssh-8.1p1-seccomp-nanosleep.patch
@@ -0,0 +1,27 @@
1commit 7e929163ed40f9ce90060a3ca6df558c3d901379
2Author: Jakub Jelen <jjelen@redhat.com>
3Date: Wed Nov 13 12:57:05 2019 +0100
4
5seccomp: Allow clock_nanosleep() to make OpenSSH working with latest glibc
6sandbox-seccomp: Allow clock_nanosleep on ARM
7
8Upstream-Status: Backport [https://github.com/tcely/openssh-portable/pull/258]
9 [https://github.com/bobby0809/openssh-portable/pull/138]
10
11Signed-off-by: Khem Raj <raj.khem@gmail.com
12
13--- a/sandbox-seccomp-filter.c
14+++ b/sandbox-seccomp-filter.c
15@@ -242,6 +242,12 @@ static const struct sock_filter preauth_
16 #ifdef __NR_nanosleep
17 SC_ALLOW(__NR_nanosleep),
18 #endif
19+#ifdef __NR_clock_nanosleep
20+ SC_ALLOW(__NR_clock_nanosleep),
21+#endif
22+#ifdef __NR_clock_nanosleep_time64
23+ SC_ALLOW(__NR_clock_nanosleep_time64),
24+#endif
25 #ifdef __NR__newselect
26 SC_ALLOW(__NR__newselect),
27 #endif
diff --git a/meta/recipes-connectivity/openssh/openssh_8.1p1.bb b/meta/recipes-connectivity/openssh/openssh_8.1p1.bb
index 024ebca402..f8be7ba178 100644
--- a/meta/recipes-connectivity/openssh/openssh_8.1p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_8.1p1.bb
@@ -24,6 +24,8 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
24 file://fix-potential-signed-overflow-in-pointer-arithmatic.patch \ 24 file://fix-potential-signed-overflow-in-pointer-arithmatic.patch \
25 file://sshd_check_keys \ 25 file://sshd_check_keys \
26 file://add-test-support-for-busybox.patch \ 26 file://add-test-support-for-busybox.patch \
27 file://openssh-8.1p1-seccomp-nanosleep.patch \
28 file://0001-seccomp-Allow-clock_gettime64-in-sandbox.patch \
27 " 29 "
28SRC_URI[md5sum] = "513694343631a99841e815306806edf0" 30SRC_URI[md5sum] = "513694343631a99841e815306806edf0"
29SRC_URI[sha256sum] = "02f5dbef3835d0753556f973cd57b4c19b6b1f6cd24c03445e23ac77ca1b93ff" 31SRC_URI[sha256sum] = "02f5dbef3835d0753556f973cd57b4c19b6b1f6cd24c03445e23ac77ca1b93ff"