summaryrefslogtreecommitdiff
path: root/sandbox-seccomp-filter.c
Commit message (Collapse)AuthorAgeFilesLines
* Improve seccomp compat on older systems.Darren Tucker2023-02-111-2/+16
| | | | | | Check if flags to mmap and madvise are defined before using them. Should fix problems building on older Linux systems that don't have these. bz#3537, with & ok djm@.
* harden Linux seccomp sandboxDamien Miller2023-02-061-5/+74
| | | | | | | | | | | | | | | | | | | Linux mmap(2) and madvise(2) syscalls support quite a number of funky flags that we don't expect that sshd/libc will ever need. We can exclude this kernel attack surface by filtering the mmap(2) flags and the madvise(2) advice arguments. Similarly, the sandboxed process in sshd is a single-threaded program that does not use shared memory for synchronisation or communication. Therefore, there should be no reason for the advanced priority inheritance futex(2) operations to be necessary. These can also be excluded. Motivated by Jann Horn pointing out that there have been kernel bugs in nearby Linux kernel code, e.g. CVE-2020-29368, CVE-2020-29374 and CVE-2022-42703. Feedback Jann Horn, ok dtucker@
* Allow writev is seccomp sandbox.Darren Tucker2023-01-141-0/+3
| | | | | This seems to be used by recent glibcs at least in some configurations. From bz#3512, ok djm@
* disable SANDBOX_SECCOMP_FILTER_DEBUGDamien Miller2022-12-071-1/+1
| | | | | | It was mistakenly enabled in 2580916e4872 Reported by Peter sec-openssh-com.22.fichtner AT 0sg.net
* fix SANDBOX_SECCOMP_FILTER_DEBUGDamien Miller2022-08-111-6/+9
|
* Allow ppoll_time64 in seccomp sandbox.Darren Tucker2022-02-261-0/+3
| | | | | | Should fix sandbox violations on (some? at least i386 and armhf) 32bit Linux platforms. Patch from chutzpahu at gentoo.org and cjwatson at debian.org via bz#3396.
* sandbox-seccomp-filter: allow gettidAlex James2022-01-311-0/+3
| | | | | | | Some allocators (such as Scudo) use gettid while tracing allocations [1]. Allow gettid in preauth to prevent sshd from crashing with Scudo. [1]: https://github.com/llvm/llvm-project/blob/llvmorg-13.0.0/compiler-rt/lib/gwp_asan/common.cpp#L46
* adjust seccomp filter for select->poll conversionDamien Miller2021-11-181-2/+9
| | | | | | Needed to add ppoll syscall but also to relax the fallback rlimit sandbox. Linux poll() fails with EINVAL if npfds > RLIMIT_NOFILE, so we have to allow a single fd in the rlimit.
* polish whitespace for portable filesDamien Miller2021-04-031-3/+3
|
* Allow (but return EACCES) fstatat64 in sandbox.Darren Tucker2021-03-121-0/+3
| | | | | This is apparently used in some configurations of OpenSSL when glibc has getrandom(). bz#3276, patch from Kris Karas, ok djm@
* Add __NR_futex_time64 to seccomp sandbox.Darren Tucker2021-02-111-0/+3
| | | | | This is apparently needed for (some) 32 bit platforms with glibc 2.33. Patch from nix at esperi.org.uk and jjelen at redhat.com via bz#3260.
* Deny (non-fatal) statx in preauth privsep child.Luca Weiss2021-02-051-0/+3
|
* Add new pselect6_time64 syscall on ARM.Darren Tucker2020-11-201-0/+3
| | | | | This is apparently needed on armhfp/armv7hl. bz#3232, patch from jjelen at redhat.com.
* Add sys/syscall.h for syscall numbers.Darren Tucker2020-04-151-0/+1
| | | | | | In some architecture/libc configurations we need to explicitly include sys/syscall.h for the syscall number (__NR_xxx) definitions. bz#3085, patch from blowfist at xroutine.net.
* add clock_gettime64(2) to sandbox allowed syscallsDamien Miller2020-02-031-0/+3
| | | | bz3093
* Deny (non-fatal) ipc in preauth privsep child.Jeremy Drake2020-01-081-0/+3
| | | | | | | As noted in openssh/openssh-portable#149, i386 does not have have _NR_shmget etc. Instead, it has a single ipc syscall (see man 2 ipc, https://linux.die.net/man/2/ipc). Add this syscall, if present, to the list of syscalls that seccomp will deny non-fatally.
* seccomp: Allow clock_gettime64() in sandbox.Khem Raj2020-01-081-0/+3
| | | | | This helps sshd accept connections on mips platforms with upcoming glibc ( 2.31 )
* Allow clock_nanosleep_time64 in seccomp sandbox.Darren Tucker2019-12-161-0/+3
| | | | Needed on Linux ARM. bz#3100, patch from jjelen@redhat.com.
* Remove duplicate __NR_clock_nanosleepDarren Tucker2019-11-131-3/+0
|
* seccomp: Allow clock_nanosleep() in sandbox.Darren Tucker2019-11-131-0/+6
| | | | | seccomp: Allow clock_nanosleep() to make OpenSSH working with latest glibc. Patch from Jakub Jelen <jjelen@redhat.com> via bz #3093.
* Enable specific ioctl call for EP11 crypto card (s390)Eduardo Barretto2019-10-051-0/+2
| | | | | | | The EP11 crypto card needs to make an ioctl call, which receives an specific argument. This crypto card is for s390 only. Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
* Deny (non-fatal) shmget/shmat/shmdt in preauth privsep child.Lonnie Abelbeck2019-10-021-0/+9
| | | | | New wait_random_seeded() function on OpenSSL 1.1.1d uses shmget, shmat, and shmdt in the preauth codepath, deny (non-fatal) in seccomp_filter sandbox.
* use SC_ALLOW_ARG_MASK to limit mmap protectionsDamien Miller2019-08-231-2/+2
| | | | Restrict to PROT_(READ|WRITE|NONE), i.e. exclude PROT_EXEC
* allow mprotect(2) with PROT_(READ|WRITE|NONE) onlyDamien Miller2019-08-231-2/+24
| | | | | Used by some hardened heap allocators. Requested by Yegor Timoshenko in https://github.com/openssh/openssh-portable/pull/142
* allow s390 specific ioctl for ecc hardware supportHarald Freudenberger2019-06-051-0/+1
| | | | | | | | | | | | | | | | | | | Adding another s390 specific ioctl to be able to support ECC hardware acceleration to the sandbox seccomp filter rules. Now the ibmca openssl engine provides elliptic curve cryptography support with the help of libica and CCA crypto cards. This is done via jet another ioctl call to the zcrypt device driver and so there is a need to enable this on the openssl sandbox. Code is s390 specific and has been tested, verified and reviewed. Please note that I am also the originator of the previous changes in that area. I posted these changes to Eduardo and he forwarded the patches to the openssl community. Signed-off-by: Harald Freudenberger <freude@linux.ibm.com> Reviewed-by: Joerg Schmidbauer <jschmidb@de.ibm.com>
* add futex(2) syscall to seccomp sandboxDamien Miller2018-09-151-0/+3
| | | | | | Apparently needed for some glibc/openssl combinations. Patch from Arkadiusz Miśkiewicz
* Permit getuid()/geteuid() syscalls.Damien Miller2018-05-251-0/+12
| | | | | Requested for Linux/s390; patch from Eduardo Barretto via bz#2752; ok dtucker
* Allow nanosleep in preauth privsep child.Darren Tucker2018-04-131-0/+3
| | | | | The new timing attack mitigation code uses nanosleep in the preauth codepath, allow in sandbox.
* Fix typo in "socketcall".Darren Tucker2017-04-251-1/+1
| | | | Pointed out by jjelen at redhat.com.
* Deny socketcall in seccomp filter on ppc64le.Darren Tucker2017-04-241-0/+1
| | | | | | | | | | OpenSSL is using socket() calls (in FIPS mode) when handling ECDSA keys in privsep child. The socket() syscall is already denied in the seccomp filter, but in ppc64le kernel, it is implemented using socketcall() syscall, which is not denied yet (only SYS_SHUTDOWN is allowed) and therefore fails hard. Patch from jjelen at redhat.com.
* Missing header on Linux/s390Damien Miller2017-03-221-0/+3
| | | | Patch from Jakub Jelen
* Fix syntax error on Linux/X32Damien Miller2017-03-211-1/+1
| | | | Patch from Mike Frysinger
* Make seccomp-bpf sandbox work on Linux/X32Damien Miller2017-03-141-1/+9
| | | | | | Allow clock_gettime syscall with X32 bit masked off. Apparently this is required for at least some kernel versions. bz#2142 Patch mostly by Colin Watson. ok dtucker@
* Remove macro trickery; no binary changeDamien Miller2017-03-141-40/+40
| | | | | | | | This stops the SC_ALLOW(), SC_ALLOW_ARG() and SC_DENY() macros prepending __NR_ to the syscall number parameter and just makes them explicit in the macro invocations. No binary change in stripped object file before/after.
* support ioctls for ICA crypto card on Linux/s390Damien Miller2017-03-141-0/+6
| | | | Based on patch from Eduardo Barretto; ok dtucker@
* Fix weakness in seccomp-bpf sandbox arg inspectionDamien Miller2017-03-141-4/+20
| | | | | | | | | | | | Syscall arguments are passed via an array of 64-bit values in struct seccomp_data, but we were only inspecting the bottom 32 bits and not even those correctly for BE systems. Fortunately, the only case argument inspection was used was in the socketcall filtering so using this for sandbox escape seems impossible. ok dtucker
* Deny lstat syscalls in seccomp sandboxDamien Miller2016-05-201-0/+6
| | | | Avoids sandbox violations for some krb/gssapi libraries.
* allow getrandom syscall; from Felix von LeitnerDamien Miller2015-09-101-0/+3
|
* upstream commitdjm@openbsd.org2015-06-301-0/+3
| | | | | | | | add getpid to sandbox, reachable by grace_alarm_handler reported by Jakub Jelen; bz#2419 Upstream-ID: d0da1117c16d4c223954995d35b0f47c8f684cd8
* add missing pselect6Damien Miller2015-06-251-0/+3
| | | | patch from Jakub Jelen
* trivial optimisation for seccomp-bpfDamien Miller2015-06-171-1/+1
| | | | | | When doing arg inspection and the syscall doesn't match, skip past the instruction that reloads the syscall into the accumulator, since the accumulator hasn't been modified at this point.
* aarch64 support for seccomp-bpf sandboxDamien Miller2015-06-171-20/+85
| | | | | Also resort and tidy syscall list. Based on patches by Jakub Jelen bz#2361; ok dtucker@
* - (djm) [sandbox-seccomp-filter.c] Allow mremap and exit for DietLibc;Damien Miller2014-09-101-0/+4
| | | | patch from Felix von Leitner; ok dtucker
* - (djm) [sandbox-seccomp-filter.c] Soft-fail stat() syscalls. Add XXX toDamien Miller2014-03-171-0/+3
| | | | remind myself to add sandbox violation logging via the log socket.
* - (djm) [sandbox-seccomp-filter.c] Not all Linux architectures defineDamien Miller2014-02-061-0/+2
| | | | __NR_shutdown; some go via the socketcall(2) multiplexer.
* - (djm) [sandbox-seccomp-filter.c sandbox-systrace.c] Allow shutdown(2)Damien Miller2014-01-311-0/+1
| | | | syscall from sandboxes; it may be called by packet_close.
* - (djm) [Makefile.in configure.ac sandbox-capsicum.c sandbox-darwin.c]Damien Miller2014-01-171-1/+1
| | | | | | | [sandbox-null.c sandbox-rlimit.c sandbox-seccomp-filter.c] [sandbox-systrace.c ssh-sandbox.h sshd.c] Support preauth sandboxing using the Capsicum API introduced in FreeBSD 10. Patch by Dag-Erling Smorgrav, updated by Loganaden Velvindron @ AfriNIC; ok dtucker@
* - (dtucker) [sandbox-seccomp-filter.c] Allow clock_gettimeofday.Darren Tucker2013-06-021-0/+1
|
* - (djm) [configure.ac sandbox-seccomp-filter.c] Support for LinuxDamien Miller2013-02-221-0/+8
| | | | | seccomp-bpf sandbox on ARM. Patch from shawnlandden AT gmail.com; ok dtucker
* - (djm) [sandbox-seccomp-filter.c] fallback to rlimit if seccomp filter isDamien Miller2012-07-061-3/+9
| | | | | not available. Allows use of sshd compiled on host with a filter-capable kernel on hosts that lack the support. bz#2011 ok dtucker@
View Lorry Controller Status