From: Damien Miller <djm@mindrot.org>
Date: Thu, 30 Jan 2014 22:25:34 +0000 (+1100)
Subject:  - (djm) [sandbox-seccomp-filter.c sandbox-systrace.c] Allow shutdown(2)
X-Git-Tag: V_6_6_P1~51
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7e5cec6070673e9f9785ffc749837ada22fbe99f;p=thirdparty%2Fopenssh-portable.git

 - (djm) [sandbox-seccomp-filter.c sandbox-systrace.c] Allow shutdown(2)
   syscall from sandboxes; it may be called by packet_close.
---

diff --git a/ChangeLog b/ChangeLog
index c0dab651b..f9740631e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+20140131
+ - (djm) [sandbox-seccomp-filter.c sandbox-systrace.c] Allow shutdown(2)
+   syscall from sandboxes; it may be called by packet_close.
+
 20140130
  - (djm) [configure.ac] Only check for width-specified integer types
    in headers that actually exist. patch from Tom G. Christensen;
diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
index 2f73067e1..dbda60bab 100644
--- a/sandbox-seccomp-filter.c
+++ b/sandbox-seccomp-filter.c
@@ -98,6 +98,7 @@ static const struct sock_filter preauth_insns[] = {
 	SC_ALLOW(read),
 	SC_ALLOW(write),
 	SC_ALLOW(close),
+	SC_ALLOW(shutdown),
 	SC_ALLOW(brk),
 	SC_ALLOW(poll),
 #ifdef __NR__newselect
diff --git a/sandbox-systrace.c b/sandbox-systrace.c
index 53fbd47cb..3d4677838 100644
--- a/sandbox-systrace.c
+++ b/sandbox-systrace.c
@@ -66,6 +66,7 @@ static const struct sandbox_policy preauth_policy[] = {
 	{ SYS_munmap, SYSTR_POLICY_PERMIT },
 	{ SYS_read, SYSTR_POLICY_PERMIT },
 	{ SYS_select, SYSTR_POLICY_PERMIT },
+	{ SYS_shutdown, SYSTR_POLICY_PERMIT },
 	{ SYS_sigprocmask, SYSTR_POLICY_PERMIT },
 	{ SYS_write, SYSTR_POLICY_PERMIT },
 	{ -1, -1 }