dilim/openssh-portable
1
0 Fork 0
mirror of https://github.com/openssh/openssh-portable.git synced 2026-11-06 05:16:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

Make failure to set SECCOMP or NO_NEW_PRIVS fatal

Browse Source 
If your Linux system lacks support for these then please don't
enable the seccomp sandbox.

Prompted by manfred.kaiser@ssh-mitm.at
This commit is contained in:
Damien Miller committed 2026-05-30 23:30:13 +10:00
1 parent 4f4aeee6ed
commit 7ab700f170
1 file changed
+3 -11
Download Patch File Download Diff File Expand all files Collapse all files
sandbox-seccomp-filter.c
+3 -11
View File
@@ -535,7 +535,6 @@ void
ssh_sandbox_child(struct ssh_sandbox *box)
{
struct rlimit rl_zero, rl_one = {.rlim_cur = 1, .rlim_max = 1};
int nnp_failed = 0;
/* Set rlimits for completeness if possible. */
rl_zero.rlim_cur = rl_zero.rlim_max = 0;
@@ -558,18 +557,11 @@ ssh_sandbox_child(struct ssh_sandbox *box)
#endif /* SANDBOX_SECCOMP_FILTER_DEBUG */
debug3_f("setting PR_SET_NO_NEW_PRIVS");
if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1) {
debug("%s: prctl(PR_SET_NO_NEW_PRIVS): %s",
__func__, strerror(errno));
nnp_failed = 1;
}
if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1)
fatal_f("prctl(PR_SET_NO_NEW_PRIVS): %s", strerror(errno));
debug3_f("attaching seccomp filter program");
if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &preauth_program) == -1)
debug("%s: prctl(PR_SET_SECCOMP): %s",
__func__, strerror(errno));
else if (nnp_failed)
fatal("%s: SECCOMP_MODE_FILTER activated but "
"PR_SET_NO_NEW_PRIVS failed", __func__);
fatal_f("prctl(PR_SET_SECCOMP): %s", strerror(errno));
}
#endif /* SANDBOX_SECCOMP_FILTER */