[openssh-commits] [openssh] 02/87: don't allow the mmap(2) syscall on Linux/i386

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 07ffcabecb458f22e8b099c9faa8b235033eb423
Author: Damien Miller <djm at mindrot.org>
AuthorDate: Fri Oct 30 12:47:37 2026 +1100

    don't allow the mmap(2) syscall on Linux/i386
    
    apparently this maps to old_mmap() which uses indirect flags passing that
    we can't inspect. The mmap2(2) syscall (that we can inspect) is also supported
    and used by glibc on this platform so this should be okay.
    
    Anthropic ANT-2026-AQZ97XUN
---
 sandbox-seccomp-filter.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
index b3bce6802..9454f18ee 100644
--- a/sandbox-seccomp-filter.c
+++ b/sandbox-seccomp-filter.c
@@ -360,7 +360,15 @@ static const struct sock_filter preauth_insns[] = {
 # endif
 	SC_DENY(__NR_madvise, EINVAL),
 #endif
-#ifdef __NR_mmap
+#if defined(__NR_mmap) && !defined(__i386__)
+	/*
+	 * On i386, __NR_mmap is old_mmap(2), which takes its arguments via
+	 * a struct in memory that the filter cannot inspect, so SC_MMAP's
+	 * prot and flags checks would be ineffective. Don't allow it; libc
+	 * uses mmap2(2) there. NB. s390 passes the arguments to both
+	 * variants this way and has no alternative, so the checks cannot
+	 * be relied upon on that platform.
+	 */
 	SC_MMAP(__NR_mmap),
 #endif
 #ifdef __NR_mmap2

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.