similar to: [Bug 2011] sandbox selection needs some kind of fallback mechanism

https://bugzilla.mindrot.org/show_bug.cgi?id=2011 Bug #: 2011 Summary: sandbox selection needs some kind of fallback mechanism Classification: Unclassified Product: Portable OpenSSH Version: 6.0p1 Platform: All OS/Version: All Status: NEW Severity: normal Priority: P2

https://bugzilla.mindrot.org/show_bug.cgi?id=2011 Damien Miller <djm at mindrot.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED --- Comment #14 from Damien Miller <djm at mindrot.org> --- Set all RESOLVED bugs to CLOSED with

https://bugzilla.mindrot.org/show_bug.cgi?id=2011 --- Comment #8 from Petr Lautrbach <plautrba at redhat.com> --- Created attachment 2214 --> https://bugzilla.mindrot.org/attachment.cgi?id=2214&action=edit don't probe seccomp capability of running kernel in configure I'd like to add also possibility to build seccomp_filter sandbox on system with older kernel, E.g. Fedora

https://bugzilla.mindrot.org/show_bug.cgi?id=1940 Damien Miller <djm at mindrot.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks|2360 | --- Comment #17 from Damien Miller <djm at mindrot.org> --- I'm not sure we want this - everyone is

https://bugzilla.mindrot.org/show_bug.cgi?id=1940 Jakub Jelen <jjelen at redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jjelen at redhat.com --- Comment #18 from Jakub Jelen <jjelen at redhat.com> --- (In reply to Damien Miller

While debugging Scudo on ChromeOS, we found that the no reserve mode immediately crashed `sshd`. We tracked it down to the sandbox-seccomp-filter. Being able to mmap with MAP_NORESERVE is useful (if not necessary) for some overcommitting allocators. During mmap calls, the flag MAP_NORESERVE is used by some allocators such as LLVM's Scudo for layout optimisation. This causes the sandbox

I've committed this diff. Please test and confirm that it works ok. (If not, then I've botched the macro fixes in the previous commit) Thanks, Damien Miller On Tue, 14 Mar 2017, Damien Miller wrote: > ok, with the fixes for the seccomp-bpf sandbox that I just committed > the diff reduces to. > > IMO this is scoped narrowly enough to go in. > > -d > > diff

On 03-03-2017 09:54, Petr Cerny wrote: > Damien Miller wrote: >> On Tue, 28 Feb 2017, Eduardo Barretto wrote: >> >>> On 13-02-2017 13:23, Eduardo Barretto wrote: >>> > This patch enables specific ioctl calls for ICA crypto card on s390 >>> > platform. Without this patch, users using the IBMCA engine are not >>> able >>> > to

https://bugzilla.mindrot.org/show_bug.cgi?id=1940 Damien Miller <djm at mindrot.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |2130 --- Comment #7 from Damien Miller <djm at mindrot.org> --- Retarget to openssh-6.4 -- You are receiving

https://bugzilla.mindrot.org/show_bug.cgi?id=1940 Damien Miller <djm at mindrot.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |2188 --- Comment #9 from Damien Miller <djm at mindrot.org> --- Retarget incomplete bugs / feature requests to

https://bugzilla.mindrot.org/show_bug.cgi?id=1940 Damien Miller <djm at mindrot.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |2226 --- Comment #11 from Damien Miller <djm at mindrot.org> --- Retarget to 6.7 release, since 6.6 was mostly

https://bugzilla.mindrot.org/show_bug.cgi?id=1940 Damien Miller <djm at mindrot.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |2266 --- Comment #13 from Damien Miller <djm at mindrot.org> --- Retarget incomplete bugs to 6.8 release. --

https://bugzilla.mindrot.org/show_bug.cgi?id=1940 Damien Miller <djm at mindrot.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks|2266 | --- Comment #15 from Damien Miller <djm at mindrot.org> --- OpenSSH 6.8 is approaching release and closed for

https://bugzilla.mindrot.org/show_bug.cgi?id=1940 Damien Miller <djm at mindrot.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |2360 --- Comment #16 from Damien Miller <djm at mindrot.org> --- Retarget to 6.9 -- You are receiving this

https://bugzilla.mindrot.org/show_bug.cgi?id=1940 Damien Miller <djm at mindrot.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED --- Comment #19 from Damien Miller <djm at mindrot.org> --- Close all resolved bugs after 7.3p1 release

http://bugzilla.mindrot.org/show_bug.cgi?id=1285 Damien Miller <djm at mindrot.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|no way to override SendEnv |provide fallback options |directive in |/etc/ssh/ssh_config

https://bugzilla.mindrot.org/show_bug.cgi?id=2107 Bug ID: 2107 Summary: seccomp sandbox breaks GSSAPI Classification: Unclassified Product: Portable OpenSSH Version: 6.2p1 Hardware: Other OS: Linux Status: NEW Severity: normal Priority: P5 Component: Kerberos support

https://bugzilla.mindrot.org/show_bug.cgi?id=1940 Damien Miller <djm at mindrot.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |WONTFIX -- You are receiving this mail because: You are

Changes since OpenSSH 6.1 ========================= This release introduces a number of new features: Features: * ssh(1)/sshd(8): Added support for AES-GCM authenticated encryption in SSH protocol 2. The new cipher is available as aes128-gcm at openssh.com and aes256-gcm at openssh.com. It uses an identical packet format to the AES-GCM mode specified in RFC 5647, but uses simpler and

Hi, This patch (relative to -HEAD) defines an API to allow sandboxing of the pre-auth privsep child and a couple of sandbox implementations. The idea here is to heavily restrict what the network-face pre-auth process can do. This was the original intent behind dropping to a dedicated uid and chrooting to an empty directory, but even this still allows a compromised slave process to make new