From patchwork Wed Jan 8 01:51:57 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Khem Raj X-Patchwork-Id: 182782 Delivered-To: patch@linaro.org Received: by 2002:a92:1f12:0:0:0:0:0 with SMTP id i18csp3194918ile; Sun, 12 Jan 2020 09:32:34 -0800 (PST) X-Google-Smtp-Source: APXvYqxZho5Jbb+K1obuFq8sqpWdrG2oIDSc2jRJvWDGANo4nqrOkn6UEBljxtb7aAJhb48qpyyZ X-Received: by 2002:a63:cb48:: with SMTP id m8mr17217238pgi.128.1578847655953; Sun, 12 Jan 2020 08:47:35 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1578847655; cv=none; d=google.com; s=arc-20160816; b=ubssCf7HFt3yPd8hC4DrygnbHQpoXV0iNHxQf+29NkMa/+Nb0KqvGRwuivnJeXaB9B hFwalNgtBiHjZ7yvjibO5lNXyzQZinp6CG91+XJ605IV83l6EEwejj5YLQfMiPQOfDAN VFpM1wgXw7FrViuBYoiYIu7wSe4HksYPFTSRHVqJcV9IB/SOgaF0gAoCDKjVi/G4hR9v a2J7ufzyQqhveVUgdlYmDbKZWrn7WA6yRIshQTwVBcscWwDAEdwiUdTPVdIE1rdTqwad MyVR9G+hQZu2uUHeLBrGMjTyQcTJzOwziaY/OD+ersn512U7DEyylXfAACYelHX3fbwf 2wKQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=errors-to:sender:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:message-id:date:to:from:dkim-signature:delivered-to; bh=lw7HGjaGLe90/4Y62BNAfn932SrJk7ju30fObKKA9VU=; b=g01vZXYP5GXm6tioDR25hGjsfdn461DVdWzVYBePdQ496cfU7ufH0f8v1cl5XLqj1w FO3D5R4PqPg7O9ef7lg+C82S/mruHL1+/2famxRR0RgsY5x5xlLJSUt2zkr2MFTZmClE QFuyWHErsasEP6reIlkCGbpvFK/A17mPc9bua4duh1f01rNsEXPfbgSy83LGVJV/SXNh hdDLwHn+z1eYWNS3QJriXrm/ngie1hj8sZEacYvqpDOSQ9fejuEDAK4OeGMhmKAQBk9N WCpeOzjvYkmG+Y/2iOy4B4BCT5ymX9yBzrC5KQJZxV86RF2d1qd1A6UYmZUCgFU0FY8C z2WQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20161025 header.b=JDvFihDO; spf=pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) smtp.mailfrom=openembedded-core-bounces@lists.openembedded.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from mail.openembedded.org (mail.openembedded.org. [140.211.169.62]) by mx.google.com with ESMTP id u8si9069439plq.181.2020.01.12.08.47.35 for ; Sun, 12 Jan 2020 08:47:35 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) client-ip=140.211.169.62; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20161025 header.b=JDvFihDO; spf=pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) smtp.mailfrom=openembedded-core-bounces@lists.openembedded.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from ec2-34-214-78-129.us-west-2.compute.amazonaws.com (localhost [127.0.0.1]) by mail.openembedded.org (Postfix) with ESMTP id 4EF157FCD1; Wed, 8 Jan 2020 01:52:04 +0000 (UTC) X-Original-To: openembedded-core@lists.openembedded.org Delivered-To: openembedded-core@lists.openembedded.org Received: from mail-pf1-f173.google.com (mail-pf1-f173.google.com [209.85.210.173]) by mail.openembedded.org (Postfix) with ESMTP id 2CA677FCAC for ; Wed, 8 Jan 2020 01:52:02 +0000 (UTC) Received: by mail-pf1-f173.google.com with SMTP id q10so779662pfs.6 for ; Tue, 07 Jan 2020 17:52:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=fqqq8p1gr1+vfSp1wHrOldv5bAYI7tRLM57HnWYVLTU=; b=JDvFihDOhbdYFRLFlaXe80hwp52XW1hJKLiR5mBRubVT8jYmF1HYc4N1oekW6LaozU NCpKcy82F/U4uJeC177CNOGJAxt1x9DxsRXm5rIXcgW/EHbLQ3UBps+llTHO8T1suKxQ A702O9LHlOA7KtzKhWQ46ko46etMb2XxfxTv2k/FydrjDJjO3YbhWXzN/NRYGkOIXghm syNqPnE8VUsTOYRR3BBhiozrFZSsG972nHLpiQyhlc0CzVtvudag9zCS/WmhVhQqzICh 547tnIN+2mG+KXsFathms5PqyXs3RJihlgQjShVuaHuma9BBJ3lmSdPcEO+PTLJyRFaG jx6A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=fqqq8p1gr1+vfSp1wHrOldv5bAYI7tRLM57HnWYVLTU=; b=mAnMktU5xtwuv4kOIcZ/s4CHNUj3m6l9Dc3oXPnz8jy+lQ6AQt9xJNYOBSWpcqxupf hQiL2I8NrJCGEMBxdOYa9VQSaLzeCvvljusuT4qq5qA7sTCw3cd5aFkxBtuU/nQayM/6 NwExW/FCf7lfhcVolxJaznpA6v2hJtkzS8inUZwkT6a/K9x9sb7cNnGQIQSXVIinLI+u qrI6YoE29uHLy/XBlxVZ2P/5cqC0SKzrGPKxwnnm/ixFSrFrbfDEkBku3csb2mCW7Nr0 Hr9y7eIEHALVRU2ED+bHrbewDimlA68XKyOUfXPHyXEWMFJm2QGLuJoRTrVmX+QxGFeN nk2g== X-Gm-Message-State: APjAAAXmIeFtXdinOEJrYN7OgA5N5k/h+4K8khLHwz+aIDnWKjBq05v0 aTBttqhFysqwEKmZo1cLL2rpISpnQK0= X-Received: by 2002:a63:1a08:: with SMTP id a8mr2680318pga.425.1578448322596; Tue, 07 Jan 2020 17:52:02 -0800 (PST) Received: from apollo.hsd1.ca.comcast.net ([2601:646:9200:4e0::9bd6]) by smtp.gmail.com with ESMTPSA id g22sm1010267pgk.85.2020.01.07.17.52.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 07 Jan 2020 17:52:01 -0800 (PST) From: Khem Raj To: openembedded-core@lists.openembedded.org Date: Tue, 7 Jan 2020 17:51:57 -0800 Message-Id: <20200108015157.3699714-1-raj.khem@gmail.com> X-Mailer: git-send-email 2.24.1 MIME-Version: 1.0 Subject: [OE-core] [PATCH] openssh: Allow clock_nanosleep/clock_gettime64/clock_nanosleep_time64 syscall X-BeenThere: openembedded-core@lists.openembedded.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Patches and discussions about the oe-core layer List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: openembedded-core-bounces@lists.openembedded.org Errors-To: openembedded-core-bounces@lists.openembedded.org Fixes connection denials with these syscalls being there on upcoming glibc 2.31 release Signed-off-by: Khem Raj --- ...omp-Allow-clock_gettime64-in-sandbox.patch | 31 +++++++++++++++++++ .../openssh-8.1p1-seccomp-nanosleep.patch | 27 ++++++++++++++++ .../openssh/openssh_8.1p1.bb | 2 ++ 3 files changed, 60 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/0001-seccomp-Allow-clock_gettime64-in-sandbox.patch create mode 100644 meta/recipes-connectivity/openssh/openssh/openssh-8.1p1-seccomp-nanosleep.patch -- 2.24.1 -- _______________________________________________ Openembedded-core mailing list Openembedded-core@lists.openembedded.org http://lists.openembedded.org/mailman/listinfo/openembedded-core diff --git a/meta/recipes-connectivity/openssh/openssh/0001-seccomp-Allow-clock_gettime64-in-sandbox.patch b/meta/recipes-connectivity/openssh/openssh/0001-seccomp-Allow-clock_gettime64-in-sandbox.patch new file mode 100644 index 0000000000..78c493de86 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/0001-seccomp-Allow-clock_gettime64-in-sandbox.patch @@ -0,0 +1,31 @@ +From eae3e85322fa7c869f5822db4eda6348f2beb09e Mon Sep 17 00:00:00 2001 +From: Khem Raj +Date: Tue, 7 Jan 2020 16:26:45 -0800 +Subject: [PATCH] seccomp: Allow clock_gettime64() in sandbox. + +This helps sshd accept connections on mips platforms with +upcoming glibc ( 2.31 ) + +Upstream-Status: Accepted [https://github.com/openssh/openssh-portable/pull/161] +Signed-off-by: Khem Raj +--- + sandbox-seccomp-filter.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c +index 3ef30c9..999c46c 100644 +--- a/sandbox-seccomp-filter.c ++++ b/sandbox-seccomp-filter.c +@@ -248,6 +248,9 @@ static const struct sock_filter preauth_insns[] = { + #ifdef __NR_clock_nanosleep_time64 + SC_ALLOW(__NR_clock_nanosleep_time64), + #endif ++#ifdef __NR_clock_gettime64 ++ SC_ALLOW(__NR_clock_gettime64), ++#endif + #ifdef __NR__newselect + SC_ALLOW(__NR__newselect), + #endif +-- +2.24.1 + diff --git a/meta/recipes-connectivity/openssh/openssh/openssh-8.1p1-seccomp-nanosleep.patch b/meta/recipes-connectivity/openssh/openssh/openssh-8.1p1-seccomp-nanosleep.patch new file mode 100644 index 0000000000..7c9d61c26d --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/openssh-8.1p1-seccomp-nanosleep.patch @@ -0,0 +1,27 @@ +commit 7e929163ed40f9ce90060a3ca6df558c3d901379 +Author: Jakub Jelen +Date: Wed Nov 13 12:57:05 2019 +0100 + +seccomp: Allow clock_nanosleep() to make OpenSSH working with latest glibc +sandbox-seccomp: Allow clock_nanosleep on ARM + +Upstream-Status: Backport [https://github.com/tcely/openssh-portable/pull/258] + [https://github.com/bobby0809/openssh-portable/pull/138] + +Signed-off-by: Khem Raj