diff options
| author | Colin Watson <cjwatson@debian.org> | 2018-02-08 22:43:52 +0000 |
|---|---|---|
| committer | Colin Watson <cjwatson@debian.org> | 2018-02-08 22:43:52 +0000 |
| commit | 6230e97a21712c90324c0a414bf873e59f82ce7b (patch) | |
| tree | f93f978091c8d90ebcb03bd062a759453b9453a6 | |
| parent | 3d4ab15670079aa8e898f80a650b3be941230486 (diff) | |
| download | man-db-6230e97a21712c90324c0a414bf873e59f82ce7b.tar.gz | |
sandbox: Allow mremap
* lib/sandbox.c (make_seccomp_filter): Allow mremap, which may be used
by iconv when reading files, depending on libc configuration.
* NEWS: Document this.
| -rw-r--r-- | NEWS | 2 | ||||
| -rw-r--r-- | lib/sandbox.c | 1 |
2 files changed, 3 insertions, 0 deletions
@@ -10,6 +10,8 @@ Major changes since man-db 2.8.0: * Fix manconv execution under seccomp when man is installed setuid. + * Make seccomp sandbox allow mremap (used by iconv, for example). + Improvements: ------------- diff --git a/lib/sandbox.c b/lib/sandbox.c index be83444..2e730b2 100644 --- a/lib/sandbox.c +++ b/lib/sandbox.c @@ -433,6 +433,7 @@ scmp_filter_ctx make_seccomp_filter (int permissive) else SC_ALLOW_ARG_1 ("ioctl", SCMP_A1 (SCMP_CMP_EQ, TCGETS)); SC_ALLOW ("mprotect"); + SC_ALLOW ("mremap"); SC_ALLOW ("sync_file_range2"); SC_ALLOW ("sysinfo"); SC_ALLOW ("uname"); |
