bugDatabase-driven manual pager suite - Bugs: bug #56767, add `getrandom` to seccomp-bpf...

 
 

bug #56767: add `getrandom` to seccomp-bpf filter - compatibility with Hardened Malloc

Submitter:  adrelanos <adrelanos>
Submitted:  Sat 17 Aug 2019 12:19:49 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  cjwatson
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Mon 26 Aug 2019 04:46:18 PM UTC, comment #2: 

Fixed in man-db 2.8.7.

Colin Watson <cjwatson>
Group administrator
Wed 21 Aug 2019 01:32:19 PM UTC, comment #1: 
Colin Watson <cjwatson>
Group administrator
Sat 17 Aug 2019 12:19:49 PM UTC, original submission:  

https://github.com/GrapheneOS/hardened_malloc/issues/89#issuecomment-521759557

> @adrelanos Maybe you can get the man-db maintainers to add `getrandom` to their seccomp-bpf filter since that's the only case of breakage that I know about at the moment. The `getrandom` system call is also used by various other libc hardening, although they might not do anything that would trigger it. The reason this calls `getrandom` after initialization is to reseed the per-size-class CSPRNGs occasionally as a minor security enhancement. If I had a way to detect that it would kill the process, I could just not do it, but it would be best if people just didn't blacklist `getrandom` when they're using `malloc` because hardened allocators should be allowed to use it.


adrelanos <adrelanos>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by cjwatson (Posted a comment)
  • -email is unavailable- added by adrelanos (Submitted the item)
  • -email is unavailable- added by adrelanos
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2019-08-26 cjwatson StatusReady For Test Fixed
        Open/ClosedOpen Closed
    2019-08-21 cjwatson StatusNone Ready For Test
        Assigned toNone cjwatson
    2019-08-17 adrelanos Carbon-Copy- Added adrelanos

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code