[openssh-commits] [openssh] 04/87: harden seccomp sandbox wrt clock syscalls

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 5f707ab7f922de0411c03a3bf41851c584a485ee
Author: Damien Miller <djm at mindrot.org>
AuthorDate: Fri Oct 30 15:41:33 2026 +1100

    harden seccomp sandbox wrt clock syscalls
    
    Restrict the clock syscalls' first argument to positive clock IDs only.
    Negative clock IDs represent other processes' clocks.
    
    This avoids a compromised unpriv process from probing other PIDs and
    their clocks and/or blocking on their clocks.
    
    Anthropic ANT-2026-UQT74MC0
---
 sandbox-seccomp-filter.c | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
index 2d83fc3e6..e18abffc3 100644
--- a/sandbox-seccomp-filter.c
+++ b/sandbox-seccomp-filter.c
@@ -226,6 +226,18 @@
 	SC_ALLOW_ARG_MASK(_nr, 2, PROT_READ|PROT_WRITE|PROT_NONE)
 #endif /* __NR_mmap || __NR_mmap2 */
 
+/*
+ * Special handling for clock_gettime(2), clock_nanosleep(2) and their
+ * time64 variants: only permit the fixed clock IDs, CLOCK_REALTIME (0)
+ * through CLOCK_BOOTTIME (7). Negative clock IDs name the CPU-time clock
+ * of an arbitrary process, which the kernel lets anyone read.
+ */
+#define SC_CLOCKID_MASK 0x7
+/* Use this for all clock_*(2) variants */
+#define SC_CLOCK(_nr) \
+	SC_ALLOW_ARG_MASK(_nr, 0, SC_CLOCKID_MASK), \
+	SC_DENY(_nr, EINVAL)
+
 /* Special handling for setsockopt(2) */
 #define SC_ALLOW_SETSOCKOPT(_level, _optname) \
 	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_setsockopt, 0, 10), \
@@ -315,10 +327,10 @@ static const struct sock_filter preauth_insns[] = {
 	SC_ALLOW(__NR_brk),
 #endif
 #ifdef __NR_clock_gettime
-	SC_ALLOW(__NR_clock_gettime),
+	SC_CLOCK(__NR_clock_gettime),
 #endif
 #ifdef __NR_clock_gettime64
-	SC_ALLOW(__NR_clock_gettime64),
+	SC_CLOCK(__NR_clock_gettime64),
 #endif
 #ifdef __NR_close
 	SC_ALLOW(__NR_close),
@@ -342,7 +354,7 @@ static const struct sock_filter preauth_insns[] = {
 	SC_ALLOW(__NR_geteuid32),
 #endif
 #ifdef __NR_getpgid
-	SC_ALLOW(__NR_getpgid),
+	SC_ALLOW_ARG(__NR_getpgid, 0, 0),
 #endif
 #ifdef __NR_getpid
 	SC_ALLOW(__NR_getpid),
@@ -411,10 +423,10 @@ static const struct sock_filter preauth_insns[] = {
 	SC_ALLOW(__NR_nanosleep),
 #endif
 #ifdef __NR_clock_nanosleep
-	SC_ALLOW(__NR_clock_nanosleep),
+	SC_CLOCK(__NR_clock_nanosleep),
 #endif
 #ifdef __NR_clock_nanosleep_time64
-	SC_ALLOW(__NR_clock_nanosleep_time64),
+	SC_CLOCK(__NR_clock_nanosleep_time64),
 #endif
 #ifdef __NR__newselect
 	SC_ALLOW(__NR__newselect),
@@ -502,7 +514,7 @@ static const struct sock_filter preauth_insns[] = {
 	 * x86-64 syscall under some circumstances, e.g.
 	 * https://bugs.debian.org/849923
 	 */
-	SC_ALLOW(__NR_clock_gettime & ~__X32_SYSCALL_BIT),
+	SC_CLOCK(__NR_clock_gettime & ~__X32_SYSCALL_BIT),
 #endif
 
 	/* Default deny */

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.