From 2fd57282f0262ca084e05b0f2c63fbada395d02b Mon Sep 17 00:00:00 2001 From: V3n3RiX Date: Sun, 16 Jan 2022 20:27:28 +0000 Subject: gentoo resync : 16.01.2021 --- .../lldpd/files/lldpd-1.0.13-r2-glibc-2.33.patch | 50 ++++++++++++++++++++++ 1 file changed, 50 insertions(+) create mode 100644 net-misc/lldpd/files/lldpd-1.0.13-r2-glibc-2.33.patch (limited to 'net-misc/lldpd/files') diff --git a/net-misc/lldpd/files/lldpd-1.0.13-r2-glibc-2.33.patch b/net-misc/lldpd/files/lldpd-1.0.13-r2-glibc-2.33.patch new file mode 100644 index 000000000000..62f8cdc2e62b --- /dev/null +++ b/net-misc/lldpd/files/lldpd-1.0.13-r2-glibc-2.33.patch @@ -0,0 +1,50 @@ +https://github.com/lldpd/lldpd/commit/0ea4b1a5e0e9c35d960145d25166e92a9990227f +https://github.com/lldpd/lldpd/commit/1def824404cfcab9f64b687da1cb7a4b4b51bbe0 + +From: Antonio Quartulli +Date: Sun, 9 Jan 2022 15:24:55 +0100 +Subject: [PATCH] linux: add access syscall to seccomp rules + +Signed-off-by: Antonio Quartulli +--- a/src/daemon/priv-seccomp.c ++++ b/src/daemon/priv-seccomp.c +@@ -178,6 +178,7 @@ priv_seccomp_init(int remote, int child) + (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(gettimeofday), 0)) < 0 || + (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(newfstatat), 0)) < 0 || + (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(pread64), 0)) < 0 || ++ (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(access), 0)) < 0 || + /* The following are for resolving addresses */ + (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mmap), 0)) < 0 || + (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(munmap), 0)) < 0 || + +From: David Sastre Medina +Date: Tue, 11 Jan 2022 14:55:05 +0100 +Subject: [PATCH] daemon: add additional syscalls to SECCOMP filter when + running in the foreground + +Running lldpd in the foreground as follows: + +strace -c /usr/sbin/lldpd -d -cfse -D -C lldpd-peer -I lldpd-peer \ + -S lldpd-system-name -m 192.168.50.6 + +Requires additional syscalls to be filtered (non relevant syscalls removed): + +% time seconds usecs/call calls errors syscall +------ ----------- ----------- --------- --------- ---------------- + 0.47 0.000026 6 4 ppoll + 0.33 0.000018 3 5 rt_sigprocmask + 0.27 0.000015 3 4 getsockopt +------ ----------- ----------- --------- --------- ---------------- +100.00 0.005520 8 637 22 total +--- a/src/daemon/priv-seccomp.c ++++ b/src/daemon/priv-seccomp.c +@@ -179,6 +179,9 @@ priv_seccomp_init(int remote, int child) + (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(newfstatat), 0)) < 0 || + (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(pread64), 0)) < 0 || + (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(access), 0)) < 0 || ++ (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(rt_sigprocmask), 0)) < 0 || ++ (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt), 0)) < 0 || ++ (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(ppoll), 0)) < 0 || + /* The following are for resolving addresses */ + (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mmap), 0)) < 0 || + (rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(munmap), 0)) < 0 || -- cgit v1.2.3