Re: [Buildroot] [PATCH] package/openssh: backport upstream fix for 32-bit

[Peter Seiderer <ps.report@gmx.net>]

Hello John,

thanks for the patch, some minor nitpicks...

Better patch subject would be:

	package/openssh: add upstream patch to add seccomp ppoll_time64 support

On Thu, 10 Mar 2022 14:03:50 +0000, John Keeping <john@metanate.com> wrote:

> sshd is broken on 32-bit systems because ppoll_time64 is used by the
> application although it is not allowed by the seccomp filter.
>
> Apply the upstream patch to fix this.

Better:

  -add upstream patch ([1] to add seccomp ppoll_time64 support

[1] https://github.com/openssh/openssh-portable/commit/284b6e5394652d519e31782e3b3cdfd7b21d1a81.patch

>
> Signed-off-by: John Keeping <john@metanate.com>
> ---
>  ...llow-ppoll_time64-in-seccomp-sandbox.patch | 31 +++++++++++++++++++
>  1 file changed, 31 insertions(+)
>  create mode 100644 package/openssh/0001-Allow-ppoll_time64-in-seccomp-sandbox.patch
>
> diff --git a/package/openssh/0001-Allow-ppoll_time64-in-seccomp-sandbox.patch b/package/openssh/0001-Allow-ppoll_time64-in-seccomp-sandbox.patch
> new file mode 100644
> index 0000000000..34b309bd9a
> --- /dev/null
> +++ b/package/openssh/0001-Allow-ppoll_time64-in-seccomp-sandbox.patch
> @@ -0,0 +1,31 @@
> +From 284b6e5394652d519e31782e3b3cdfd7b21d1a81 Mon Sep 17 00:00:00 2001
> +From: Darren Tucker <dtucker@dtucker.net>
> +Date: Sat, 26 Feb 2022 14:06:14 +1100
> +Subject: [PATCH] Allow ppoll_time64 in seccomp sandbox.
> +
> +Should fix sandbox violations on (some? at least i386 and armhf) 32bit
> +Linux platforms.  Patch from chutzpahu at gentoo.org and cjwatson at
> +debian.org via bz#3396.
> +

Missing:

[Upstream: https://github.com/openssh/openssh-portable/commit/284b6e5394652d519e31782e3b3cdfd7b21d1a81.patch]
> +Signed-off-by: John Keeping <john@metanate.com>
> +---
> + sandbox-seccomp-filter.c | 3 +++
> + 1 file changed, 3 insertions(+)
> +
> +diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
> +index 2e065ba3..4ce80cb2 100644
> +--- a/sandbox-seccomp-filter.c
> ++++ b/sandbox-seccomp-filter.c
> +@@ -276,6 +276,9 @@ static const struct sock_filter preauth_insns[] = {
> + #ifdef __NR_ppoll
> + 	SC_ALLOW(__NR_ppoll),
> + #endif
> ++#ifdef __NR_ppoll_time64
> ++	SC_ALLOW(__NR_ppoll_time64),
> ++#endif
> + #ifdef __NR_poll
> + 	SC_ALLOW(__NR_poll),
> + #endif
> +--
> +2.35.1
> +

With this fixed you can add my

Reviewed-by: Peter Seiderer <ps.report@gmx.net>

Regards,
Peter

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot