summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorColin Watson <cjwatson@debian.org>2018-02-08 22:43:52 +0000
committerColin Watson <cjwatson@debian.org>2018-02-08 22:43:52 +0000
commit6230e97a21712c90324c0a414bf873e59f82ce7b (patch)
treef93f978091c8d90ebcb03bd062a759453b9453a6
parent3d4ab15670079aa8e898f80a650b3be941230486 (diff)
downloadman-db-6230e97a21712c90324c0a414bf873e59f82ce7b.tar.gz
sandbox: Allow mremap
* lib/sandbox.c (make_seccomp_filter): Allow mremap, which may be used by iconv when reading files, depending on libc configuration. * NEWS: Document this.
-rw-r--r--NEWS2
-rw-r--r--lib/sandbox.c1
2 files changed, 3 insertions, 0 deletions
diff --git a/NEWS b/NEWS
index c40229e..701201d 100644
--- a/NEWS
+++ b/NEWS
@@ -10,6 +10,8 @@ Major changes since man-db 2.8.0:
* Fix manconv execution under seccomp when man is installed setuid.
+ * Make seccomp sandbox allow mremap (used by iconv, for example).
+
Improvements:
-------------
diff --git a/lib/sandbox.c b/lib/sandbox.c
index be83444..2e730b2 100644
--- a/lib/sandbox.c
+++ b/lib/sandbox.c
@@ -433,6 +433,7 @@ scmp_filter_ctx make_seccomp_filter (int permissive)
else
SC_ALLOW_ARG_1 ("ioctl", SCMP_A1 (SCMP_CMP_EQ, TCGETS));
SC_ALLOW ("mprotect");
+ SC_ALLOW ("mremap");
SC_ALLOW ("sync_file_range2");
SC_ALLOW ("sysinfo");
SC_ALLOW ("uname");