mir/sudo
2
0
Fork 0
mirror of https://github.com/sudo-project/sudo.git synced 2025-08-28 12:57:50 +00:00
Code Issues Releases Wiki Activity

Fix configure check for seccomp filter on Linux

Browse Source
This commit is contained in:
Todd C. Miller 2016-10-09 11:24:29 -06:00
parent 237e2f964d
commit 8e49ce07f6
4 changed files with 32 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
config.h.in
View File

@ -124,6 +124,10 @@
don't. */ don't. */
#undef HAVE_DECL_QUAD_MIN #undef HAVE_DECL_QUAD_MIN
/* Define to 1 if you have the declaration of `SECCOMP_SET_MODE_FILTER', and
to 0 if you don't. */
#undef HAVE_DECL_SECCOMP_SET_MODE_FILTER
/* Define to 1 if you have the declaration of `setauthdb', and to 0 if you /* Define to 1 if you have the declaration of `setauthdb', and to 0 if you
don't. */ don't. */
#undef HAVE_DECL_SETAUTHDB #undef HAVE_DECL_SETAUTHDB
@ -526,9 +530,6 @@
/* Define to 1 if you have the `posix_spawnp' function. */ /* Define to 1 if you have the `posix_spawnp' function. */
#undef HAVE_POSIX_SPAWNP #undef HAVE_POSIX_SPAWNP
/* Define to 1 if you have the `prctl' function. */
#undef HAVE_PRCTL
/* Define to 1 if you have the `pread' function. */ /* Define to 1 if you have the `pread' function. */
#undef HAVE_PREAD #undef HAVE_PREAD

30
configure vendored
View File

@ -15223,23 +15223,25 @@ fi
*-*-linux*|*-*-k*bsd*-gnu) *-*-linux*|*-*-k*bsd*-gnu)
shadow_funcs="getspnam" shadow_funcs="getspnam"
test -z "$with_pam" && AUTH_EXCL_DEF="PAM" test -z "$with_pam" && AUTH_EXCL_DEF="PAM"
# Check for linux/filter.h and prctl to use seccomp(2) # Check for SECCOMP_SET_MODE_FILTER in linux/seccomp.h
ac_fn_c_check_header_mongrel "$LINENO" "linux/filter.h" "ac_cv_header_linux_filter_h" "$ac_includes_default" ac_fn_c_check_decl "$LINENO" "SECCOMP_SET_MODE_FILTER" "ac_cv_have_decl_SECCOMP_SET_MODE_FILTER" "
if test "x$ac_cv_header_linux_filter_h" = xyes; then : #include <sys/types.h>
for ac_func in prctl #include <sys/prctl.h>
do : #include <asm/unistd.h>
ac_fn_c_check_func "$LINENO" "prctl" "ac_cv_func_prctl" #include <linux/seccomp.h>
if test "x$ac_cv_func_prctl" = xyes; then : #include <linux/filter.h>
"
if test "x$ac_cv_have_decl_SECCOMP_SET_MODE_FILTER" = xyes; then :
ac_have_decl=1
else
ac_have_decl=0
fi
cat >>confdefs.h <<_ACEOF cat >>confdefs.h <<_ACEOF
#define HAVE_PRCTL 1 #define HAVE_DECL_SECCOMP_SET_MODE_FILTER $ac_have_decl
_ACEOF _ACEOF
fi
done
fi
;; ;;
*-*-gnu*) *-*-gnu*)
# lockf() is broken on the Hurd # lockf() is broken on the Hurd

10
configure.ac
View File

@ -1962,8 +1962,14 @@ case "$host" in
*-*-linux*|*-*-k*bsd*-gnu) *-*-linux*|*-*-k*bsd*-gnu)
shadow_funcs="getspnam" shadow_funcs="getspnam"
test -z "$with_pam" && AUTH_EXCL_DEF="PAM" test -z "$with_pam" && AUTH_EXCL_DEF="PAM"
# Check for linux/filter.h and prctl to use seccomp(2) # Check for SECCOMP_SET_MODE_FILTER in linux/seccomp.h
AC_CHECK_HEADER([linux/filter.h], [AC_CHECK_FUNCS([prctl])]) AC_CHECK_DECLS([SECCOMP_SET_MODE_FILTER], [], [], [
#include <sys/types.h>
#include <sys/prctl.h>
#include <asm/unistd.h>
#include <linux/seccomp.h>
#include <linux/filter.h>
])
;; ;;
*-*-gnu*) *-*-gnu*)
# lockf() is broken on the Hurd # lockf() is broken on the Hurd

7
src/sudo_noexec.c
View File

@ -18,10 +18,9 @@
#include <sys/types.h> #include <sys/types.h>
#if defined(__linux__) && defined(HAVE_PRCTL) #if defined(HAVE_DECL_SECCOMP_SET_MODE_FILTER) && HAVE_DECL_SECCOMP_SET_MODE_FILTER
# include <sys/prctl.h> # include <sys/prctl.h>
# include <asm/unistd.h> # include <asm/unistd.h>
# include <linux/audit.h>
# include <linux/filter.h> # include <linux/filter.h>
# include <linux/seccomp.h> # include <linux/seccomp.h>
#endif #endif
@ -216,7 +215,7 @@ INTERPOSE(wordexp)
/* /*
* On Linux we can use a seccomp() filter to disable exec. * On Linux we can use a seccomp() filter to disable exec.
*/ */
#if defined(__linux) && defined(HAVE_PRCTL) #if defined(HAVE_DECL_SECCOMP_SET_MODE_FILTER) && HAVE_DECL_SECCOMP_SET_MODE_FILTER
/* Older systems may not support execveat(2). */ /* Older systems may not support execveat(2). */
#ifndef __NR_execveat #ifndef __NR_execveat
@ -251,4 +250,4 @@ noexec_ctor(void)
if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == 0) if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == 0)
(void)prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &exec_fprog); (void)prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &exec_fprog);
} }
#endif /* __linux__ && HAVE_PRCTL */ #endif /* HAVE_DECL_SECCOMP_SET_MODE_FILTER */