bugDatabase-driven manual pager suite - Bugs: bug #56767, add `getrandom` to seccomp-bpf...


bug #56767: add `getrandom` to seccomp-bpf filter - compatibility with Hardened Malloc

Submitted by:  adrelanos <adrelanos>
Submitted on:  Sat 17 Aug 2019 12:19:49 PM UTC  
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  Colin Watson <cjwatson>
Open/Closed:  Closed

Add a New Comment (Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


Mon 26 Aug 2019 04:46:18 PM UTC, comment #2: 

Fixed in man-db 2.8.7.

Colin Watson <cjwatson>
Project AdministratorIn charge of this item.
Wed 21 Aug 2019 01:32:19 PM UTC, comment #1: 
Colin Watson <cjwatson>
Project AdministratorIn charge of this item.
Sat 17 Aug 2019 12:19:49 PM UTC, original submission:  


> @adrelanos Maybe you can get the man-db maintainers to add `getrandom` to their seccomp-bpf filter since that's the only case of breakage that I know about at the moment. The `getrandom` system call is also used by various other libc hardening, although they might not do anything that would trigger it. The reason this calls `getrandom` after initialization is to reseed the per-size-class CSPRNGs occasionally as a minor security enhancement. If I had a way to detect that it would kill the process, I could just not do it, but it would be best if people just didn't blacklist `getrandom` when they're using `malloc` because hardened allocators should be allowed to use it.

adrelanos <adrelanos>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by cjwatson (Posted a comment)
  • -email is unavailable- added by adrelanos (Submitted the item)
  • -email is unavailable- added by adrelanos

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2019-08-26 cjwatson StatusReady For Test => Fixed
        Open/ClosedOpen => Closed
    2019-08-21 cjwatson StatusNone => Ready For Test
        Assigned toNone => cjwatson
    2019-08-17 adrelanos Carbon-Copy- => Added adrelanos

    Back to the top

    Powered by Savane 3.6