소스 검색

Fix sandbox crash during reload of logging configuration

Allow calls to dup() which was introduced in commit a22fbab986.

From a security perspective, I don't think this should impact the
security of the sandbox significantly. As far as I can tell, there
is nothing an adversary can do with a duplicated FD that can't be
done with the original.
Peter Gerber 4 년 전
부모
커밋
b9d81282e0
2개의 변경된 파일5개의 추가작업 그리고 0개의 파일을 삭제
  1. 4 0
      changes/bug32877
  2. 1 0
      src/lib/sandbox/sandbox.c

+ 4 - 0
changes/bug32877

@@ -0,0 +1,4 @@
+o Minor bugfixes (linux seccomp sandbox):
+  - Fix crash when reloading logging configuration while the
+    experimental sandbox is enabled. Fixes bug 29150; bugfix
+    on 0.4.1.7. Patch by Peter Gerber.

+ 1 - 0
src/lib/sandbox/sandbox.c

@@ -143,6 +143,7 @@ static int filter_nopar_gen[] = {
     SCMP_SYS(clock_gettime),
     SCMP_SYS(close),
     SCMP_SYS(clone),
+    SCMP_SYS(dup),
     SCMP_SYS(epoll_create),
     SCMP_SYS(epoll_wait),
 #ifdef __NR_epoll_pwait