|
|
* Allow sysinfo() in the seccomp sandbox otherwise
comes below OOPS: priv_sock_get_cmd as the syscall
sysinfo() not allowed
tnftp 192.168.1.1
Connected to 192.168.1.1.
220 (vsFTPd 3.0.3)
Name (192.168.1.1:root): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> prompt
Interactive mode off.
ftp> mget small*
OOPS: priv_sock_get_cmd
* use "strace -ff /usr/sbin/vsftpd" to track in both
seccomp sandbox on and seccomp sandbox off (add
seccomp_sandbox=NO in /etc/vsftpd.conf) scenarios when
type the commands at ftp client as above, the ftp
connection at server side ends up each time with SIGSYS when
call sysinfo() syscall in seccomp sandbox on case,
so we need to add sysinfo() in the seccomp sandbox if
still use seccomp sandbox for vsftpd
* The issue still exists in other distribution, Please
check https://bugzilla.redhat.com/show_bug.cgi?id=845980 for details
And check ftp://195.220.108.108/linux/fedora/linux/updates/\
24/SRPMS/p/proftpd-1.3.5b-2.fc24.src.rpm for fedora, there
is even a patch vsftpd-3.0.2-seccomp.patch as below to turn off
seccomp sandbox for vsftpd by default which also means fedora
doesn't limit the syscall any more by default.
From dd86a1c28f11fa67b1263d5dc79fa9953629d30d Mon Sep 17 00:00:00 2001
From: Martin Sehnoutka <msehnout@redhat.com>
Date: Fri, 8 Apr 2016 15:03:16 +0200
Subject: [PATCH 1/7] vsftpd-3.0.2-seccomp
---
tunables.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tunables.c b/tunables.c
index 93f85b1..b024be4 100644
--- a/tunables.c
+++ b/tunables.c
@@ -232,7 +232,7 @@ tunables_load_defaults()
tunable_isolate_network = 1;
tunable_ftp_enable = 1;
tunable_http_enable = 0;
- tunable_seccomp_sandbox = 1;
+ tunable_seccomp_sandbox = 0;
tunable_allow_writeable_chroot = 0;
tunable_accept_timeout = 60;
Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
|
