[PATCH 0/2] sandbox-seccomp-filter: logging and cleanup fixes
[email protected] Sun, 24 May 2026 10:12:06 +0200 (CEST)
| Newsgroups | gmane.network.openssh.devel |
|---|---|
| Message-ID | <[email protected]> |
Dear OpenSSH developers, the following two patches fix a logging issue and remove a duplicate syscall entry in sandbox-seccomp-filter.c. Patch 1 replaces debug() with error() when prctl(PR_SET_SECCOMP) fails. With debug(), a failure would go unnoticed in normal operation, which is a security concern as the seccomp sandbox would silently be inactive. Patch 2 removes a duplicate SC_ALLOW(__NR_clock_gettime64) block that is already covered at line 297. Manfred Kaiser _______________________________________________ openssh-unix-dev mailing list [email protected] https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
0001-sandbox-seccomp-filter-use-error-for-seccomp-setup-f.patch
(text/x-patch, 1.1 KB)
From bc6aede5fea09cab8084df8cbf29183e3320908f Mon Sep 17 00:00:00 2001 From: Manfred Kaiser <[email protected]> Date: Sun, 24 May 2026 09:52:03 +0200 Subject: [PATCH 1/2] sandbox-seccomp-filter: use error() for seccomp setup failure Replace debug() with error() when prctl(PR_SET_SECCOMP) fails. A failure with debug() would go unnoticed in normal operation (without debug logging enabled), which is a security concern as the seccomp sandbox would silently be inactive. --- sandbox-seccomp-filter.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c index 7b2444930..a3c425ec1 100644 --- a/sandbox-seccomp-filter.c +++ b/sandbox-seccomp-filter.c @@ -568,7 +568,7 @@ ssh_sandbox_child(struct ssh_sandbox *box) } debug3_f("attaching seccomp filter program"); if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &preauth_program) == -1) - debug("%s: prctl(PR_SET_SECCOMP): %s", + error("%s: prctl(PR_SET_SECCOMP): %s", __func__, strerror(errno)); else if (nnp_failed) fatal("%s: SECCOMP_MODE_FILTER activated but " -- 2.54.0
0002-sandbox-seccomp-filter-remove-duplicate-SC_ALLOW-__N.patch
(text/x-patch, 878 B)
From 8bbde4f75e3613c4b8fb0d1c389141fc3b6f2335 Mon Sep 17 00:00:00 2001 From: Manfred Kaiser <[email protected]> Date: Sun, 24 May 2026 09:53:42 +0200 Subject: [PATCH 2/2] sandbox-seccomp-filter: remove duplicate SC_ALLOW(__NR_clock_gettime64) The syscall is already permitted at line 297 in its own ifdef guard. No functional change. --- sandbox-seccomp-filter.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c index a3c425ec1..ba4833f2c 100644 --- a/sandbox-seccomp-filter.c +++ b/sandbox-seccomp-filter.c @@ -381,9 +381,6 @@ static const struct sock_filter preauth_insns[] = { #ifdef __NR_clock_nanosleep_time64 SC_ALLOW(__NR_clock_nanosleep_time64), #endif -#ifdef __NR_clock_gettime64 - SC_ALLOW(__NR_clock_gettime64), -#endif #ifdef __NR__newselect SC_ALLOW(__NR__newselect), #endif -- 2.54.0