diff --git a/1000-openssh-anolis-fix-seccomp-error.patch b/1000-openssh-anolis-fix-seccomp-error.patch new file mode 100644 index 0000000000000000000000000000000000000000..f398ce9f97813dfb49a5213a0c0c751003b2930d --- /dev/null +++ b/1000-openssh-anolis-fix-seccomp-error.patch @@ -0,0 +1,26 @@ +diff -Nur openssh-8.0p1/configure openssh-8.0p1.new/configure +--- openssh-8.0p1/configure 2021-10-29 10:17:53.162420064 +0800 ++++ openssh-8.0p1.new/configure 2021-10-29 10:24:52.638846543 +0800 +@@ -7875,6 +7875,9 @@ + aarch64*-*) + seccomp_audit_arch=AUDIT_ARCH_AARCH64 + ;; ++ loongarch64*-*) ++ seccomp_audit_arch=AUDIT_ARCH_LOONGARCH64 ++ ;; + s390x-*) + seccomp_audit_arch=AUDIT_ARCH_S390X + ;; +diff -Nur openssh-8.0p1/configure.ac openssh-8.0p1.new/configure.ac +--- openssh-8.0p1/configure.ac 2021-10-29 10:17:49.986802431 +0800 ++++ openssh-8.0p1.new/configure.ac 2021-10-29 10:25:31.102923736 +0800 +@@ -882,6 +882,9 @@ + aarch64*-*) + seccomp_audit_arch=AUDIT_ARCH_AARCH64 + ;; ++ loongarch64*-*) ++ seccomp_audit_arch=AUDIT_ARCH_LOONGARCH64 ++ ;; + s390x-*) + seccomp_audit_arch=AUDIT_ARCH_S390X + ;; diff --git a/1001-openssh-8.1p1-seccomp-nanosleep.patch b/1001-openssh-8.1p1-seccomp-nanosleep.patch new file mode 100644 index 0000000000000000000000000000000000000000..4ff852c2ed6eb0f1b3d61633de0e5fae2b82c0fc --- /dev/null +++ b/1001-openssh-8.1p1-seccomp-nanosleep.patch @@ -0,0 +1,44 @@ +commit 7e929163ed40f9ce90060a3ca6df558c3d901379 +Author: Jakub Jelen +Date: Wed Nov 13 12:57:05 2019 +0100 + + seccomp: Allow clock_nanosleep() to make OpenSSH working with latest glibc + +diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c +index b5cda70b..be239767 100644 +--- a/sandbox-seccomp-filter.c ++++ b/sandbox-seccomp-filter.c +@@ -242,6 +242,9 @@ static const struct sock_filter preauth_insns[] = { + #ifdef __NR_nanosleep + SC_ALLOW(__NR_nanosleep), + #endif ++#ifdef __NR_clock_nanosleep ++ SC_ALLOW(__NR_clock_nanosleep), ++#endif + #ifdef __NR__newselect + SC_ALLOW(__NR__newselect), + #endif + +commit 500c30eaf88f26e4a74b06717fe04afec7a7516f +Author: Jakub Jelen +Date: Wed Nov 27 11:06:55 2019 +0100 + + sandbox-seccomp: Allow clock_nanosleep on ARM + +diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c +index be239767..3ef30c9d 100644 +--- a/sandbox-seccomp-filter.c ++++ b/sandbox-seccomp-filter.c +@@ -245,6 +245,12 @@ static const struct sock_filter preauth_insns[] = { + #ifdef __NR_clock_nanosleep + SC_ALLOW(__NR_clock_nanosleep), + #endif ++#ifdef __NR_clock_nanosleep_time64 ++ SC_ALLOW(__NR_clock_nanosleep_time64), ++#endif ++#ifdef __NR_clock_gettime64 ++ SC_ALLOW(__NR_clock_gettime64), ++#endif + #ifdef __NR__newselect + SC_ALLOW(__NR__newselect), + #endif diff --git a/openssh.spec b/openssh.spec index 03de9c6a58403fbe40d96e7f768af7b9fa64dd83..8be112527e9b00d074e438762b7d9e7384c1e73c 100644 --- a/openssh.spec +++ b/openssh.spec @@ -1,3 +1,4 @@ +%define anolis_release .0.1 # Do we want SELinux & Audit %if 0%{?!noselinux:1} %global WITH_SELINUX 1 @@ -73,7 +74,7 @@ Summary: An open source implementation of SSH protocol version 2 Name: openssh Version: %{openssh_ver} -Release: %{openssh_rel}%{?dist}%{?rescue_rel} +Release: %{openssh_rel}%{anolis_release}%{?dist}%{?rescue_rel} URL: http://www.openssh.com/portable.html #URL1: http://pamsshagentauth.sourceforge.net Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz @@ -258,6 +259,13 @@ Patch981: openssh-8.0p1-sshd_include.patch # 69334996ae203c51c70bf01d414c918a44618f8e Patch982: openssh-8.0p1-client_alive_count_max.patch +Patch1001: 1001-openssh-8.1p1-seccomp-nanosleep.patch + +# Add by Anolis +# fix error: seccomp_filter sandbox not supported on loongarch64-Anolis-linux-gnu +Patch1002: 1000-openssh-anolis-fix-seccomp-error.patch +# End + License: BSD Group: Applications/Internet Requires: /sbin/nologin @@ -349,7 +357,7 @@ Requires: openssh = %{version}-%{release} Summary: PAM module for authentication with ssh-agent Group: System Environment/Base Version: %{pam_ssh_agent_ver} -Release: %{pam_ssh_agent_rel}.%{openssh_rel}%{?dist}%{?rescue_rel} +Release: %{pam_ssh_agent_rel}.%{openssh_rel}%{anolis_release}%{?dist}%{?rescue_rel} License: BSD %description @@ -492,6 +500,9 @@ popd %patch100 -p1 -b .coverity +%patch1001 -p1 +%patch1002 -p1 + autoreconf pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver} autoreconf @@ -776,6 +787,10 @@ getent passwd sshd >/dev/null || \ %endif %changelog +* Wed Apr 20 2022 Weitao Zhou - 8.0p1-13.0.1 +- seccomp: Allow check_nanosleep to better compatibility for both glibc2.28 and glibc2.32 +- Support loongarch64 seccomp_filter sandbox (xuezhixin@uniontech.com) + * Tue Oct 26 2021 Dmitry Belyavskiy - 8.0p1-13 - Upstream: ClientAliveCountMax=0 disable the connection killing behaviour (#2015828)