seccomp filter for ppc64le in FIPS mode
jjelen at redhat.com
Mon Apr 24 17:49:52 AEST 2017
OpenSSL is using socket() calls (in FIPS mode) when handling ECDSA keys
in privsep child. The socket() syscall is already denied in the seccomp
filter, but in ppc64le kernel, it is implemented using socketcall()
syscall, which is not denied yet (only SYS_SHUTDOWN is allowed) and
therefore fails hard.
See attached patch with proposed patch (deny is intentionally after
allowing the SYS_SHUTDOWN). Can we have it fixed in OpenSSH portable?
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 461 bytes
Desc: not available
More information about the openssh-unix-dev