From db3ee1d862272a36fb23adb208bfe84013e4b8f7 Mon Sep 17 00:00:00 2001 From: Peter Gerber Date: Tue, 22 Jan 2019 21:47:43 +0000 Subject: [PATCH 1/2] =?UTF-8?q?Allow=20getsockopt(=E2=80=A6,=20SOL=5FSOCKE?= =?UTF-8?q?T,=20SO=5FACCEPTCONN,=20=E2=80=A6)=20in=20sandbox?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit SO_ACCEPTCONN checks whether socket listening is enabled and is used ever since 9369152aae9527cc3764 has been merged. Closes ticket #29150 --- src/lib/sandbox/sandbox.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/lib/sandbox/sandbox.c b/src/lib/sandbox/sandbox.c index 1f0f5d858f..b652397f5a 100644 --- a/src/lib/sandbox/sandbox.c +++ b/src/lib/sandbox/sandbox.c @@ -832,6 +832,12 @@ sb_getsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter) if (rc) return rc; + rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt), + SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET), + SCMP_CMP(2, SCMP_CMP_EQ, SO_ACCEPTCONN)); + if (rc) + return rc; + #ifdef HAVE_SYSTEMD rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt), SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET), From 83b1ca9b07195cc2f2ad514043eaebfaf9e85641 Mon Sep 17 00:00:00 2001 From: Peter Gerber Date: Sat, 2 Feb 2019 23:09:44 +0000 Subject: [PATCH 2/2] Add release note for bug 29150 --- changes/bug29150 | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 changes/bug29150 diff --git a/changes/bug29150 b/changes/bug29150 new file mode 100644 index 0000000000..7696b90378 --- /dev/null +++ b/changes/bug29150 @@ -0,0 +1,3 @@ + o Minor bugfixes (linux seccomp sandbox): + - Fix startup crash when experimental sandbox support is enabled. + Fixes bug 29150; bugfix on 0.4.0.1-alpha. Patch by Peter Gerber.