[openssh-commits] [openssh] 01/01: allow s390 specific ioctl for ecc hardware support

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

dtucker pushed a commit to branch master
in repository openssh.

commit b3a77b25e5f7880222b179431a74fad76d2cf60c
Author: Harald Freudenberger <freude at linux.ibm.com>
Date:   Fri May 24 10:11:15 2019 +0200

    allow s390 specific ioctl for ecc hardware support
    
    Adding another s390 specific ioctl to be able to support ECC hardware
    acceleration to the sandbox seccomp filter rules.
    
    Now the ibmca openssl engine provides elliptic curve cryptography
    support with the help of libica and CCA crypto cards. This is done via
    jet another ioctl call to the zcrypt device driver and so there is a
    need to enable this on the openssl sandbox.
    
    Code is s390 specific and has been tested, verified and reviewed.
    
    Please note that I am also the originator of the previous changes in
    that area.  I posted these changes to Eduardo and he forwarded the
    patches to the openssl community.
    
    Signed-off-by: Harald Freudenberger <freude at linux.ibm.com>
    Reviewed-by: Joerg Schmidbauer <jschmidb at de.ibm.com>
---
 sandbox-seccomp-filter.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
index 5edbc694..56eb9317 100644
--- a/sandbox-seccomp-filter.c
+++ b/sandbox-seccomp-filter.c
@@ -250,6 +250,7 @@ static const struct sock_filter preauth_insns[] = {
 	SC_ALLOW_ARG(__NR_ioctl, 1, Z90STAT_STATUS_MASK),
 	SC_ALLOW_ARG(__NR_ioctl, 1, ICARSAMODEXPO),
 	SC_ALLOW_ARG(__NR_ioctl, 1, ICARSACRT),
+	SC_ALLOW_ARG(__NR_ioctl, 1, ZSECSENDCPRB),
 #endif
 #if defined(__x86_64__) && defined(__ILP32__) && defined(__X32_SYSCALL_BIT)
 	/*

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.