MIRRORS/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2025-12-14 14:25:53 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

vsftpd: allow newfstatat and pselect6 syscalls in the seccomp sandbox

Browse Source 
Allow newfstatat and pselect6 in the seccomp sanbox for glibc 2.33.

Fixes the following OOPS error:
root@qemux86-64:~# tnftp 192.168.1.1
Connected to 192.168.1.1.
220 (vsFTPd 3.0.3)
Name (192.168.1.1:root): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
OOPS: priv_sock_get_cmd

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This commit is contained in:
Yi Zhao 2021-03-01 12:58:15 +08:00 committed by Khem Raj
parent f8c29cd3be
commit a71d1dc472
2 changed files with 52 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
meta-networking/recipes-daemons/vsftpd/vsftpd-3.0.3/0001-seccompsandbox.c-allow-newfstatat-and-pselect6-sysca.patch Normal file
View File

@ -0,0 +1,51 @@
From 7bc261076ec94efa3197beaca39eba095d162b5e Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Fri, 26 Feb 2021 16:32:27 +0800
Subject: [PATCH] seccompsandbox.c: allow newfstatat and pselect6 syscalls in
the seccomp sandbox
Allow newfstatat and pselect6 in the seccomp sanbox for glibc 2.33.
Fixes the following OOPS error:
root@qemux86-64:~# tnftp 192.168.1.1
Connected to 192.168.1.1.
220 (vsFTPd 3.0.3)
Name (192.168.1.1:root): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
OOPS: priv_sock_get_cmd
Upstream-Status: Pending
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
seccompsandbox.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/seccompsandbox.c b/seccompsandbox.c
index 377c50e..f601241 100644
--- a/seccompsandbox.c
+++ b/seccompsandbox.c
@@ -267,6 +267,7 @@ seccomp_sandbox_setup_data_connections()
3, IPPROTO_TCP);
allow_nr(__NR_bind);
allow_nr(__NR_select);
+ allow_nr(__NR_pselect6);
if (tunable_port_enable)
{
allow_nr(__NR_connect);
@@ -411,6 +412,7 @@ seccomp_sandbox_setup_postlogin(const struct vsf_session* p_sess)
allow_nr(__NR_getdents);
allow_nr(__NR_getdents64);
allow_nr(__NR_sysinfo);
+ allow_nr(__NR_newfstatat);
/* Misc */
allow_nr(__NR_umask);
--
2.17.1

1
meta-networking/recipes-daemons/vsftpd/vsftpd_3.0.3.bb
View File

@ -22,6 +22,7 @@ SRC_URI = "https://security.appspot.com/downloads/vsftpd-${PV}.tar.gz \
${@bb.utils.contains('PACKAGECONFIG', 'tcp-wrappers', 'file://vsftpd-tcp_wrappers-support.patch', '', d)} \
${@bb.utils.contains('DISTRO_FEATURES', 'pam', '', '${NOPAM_SRC}', d)} \
file://0001-sysdeputil.c-Fix-with-musl-which-does-not-have-utmpx.patch \
file://0001-seccompsandbox.c-allow-newfstatat-and-pselect6-sysca.patch \
"
UPSTREAM_CHECK_URI = "${DEBIAN_MIRROR}/main/v/vsftpd/"