File openssh-7.7p1-seccomp_ipc_flock.patch of Package openssh

# HG changeset patch
# Parent  9d38b7292619a6d5faf554b1a88888fdfa535de7
Patch from IBM enabling the use of OpenCryptoki, submitted upstreams:

From: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
To: openssh-unix-dev@mindrot.org
Subject: [PATCH 1/3] Allow flock and ipc syscall for s390 architecture
Date: Tue,  9 May 2017 14:27:13 -0300

In order to use the OpenSSL-ibmpkcs11 engine it is needed to allow flock
and ipc calls, because this engine calls OpenCryptoki (a PKCS#11
implementation) which calls the libraries that will communicate with the
crypto cards. OpenCryptoki makes use of flock and ipc and, as of now,
this is only need on s390 architecture.

Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>

Index: openssh-9.3p2/sandbox-seccomp-filter.c
===================================================================
--- openssh-9.3p2.orig/sandbox-seccomp-filter.c
+++ openssh-9.3p2/sandbox-seccomp-filter.c
@@ -251,7 +251,7 @@ static const struct sock_filter preauth_
 #ifdef __NR_shmdt
 	SC_DENY(__NR_shmdt, EACCES),
 #endif
-#ifdef __NR_ipc
+#ifdef __NR_ipc && !defined(__s390__)
 	SC_DENY(__NR_ipc, EACCES),
 #endif
 #ifdef __NR_statx
@@ -289,6 +289,9 @@ static const struct sock_filter preauth_
 #ifdef __NR_geteuid32
 	SC_ALLOW(__NR_geteuid32),
 #endif
+#if defined(__NR_flock) && defined(__s390__)
+	SC_ALLOW(__NR_flock),
+#endif
 #ifdef __NR_getpgid
 	SC_ALLOW(__NR_getpgid),
 #endif
@@ -310,6 +313,9 @@ static const struct sock_filter preauth_
 #ifdef __NR_getuid32
 	SC_ALLOW(__NR_getuid32),
 #endif
+#if defined(__NR_ipc) && defined(__s390__)
+	SC_ALLOW(__NR_ipc),
+#endif
 #ifdef __NR_madvise
 	SC_ALLOW_ARG(__NR_madvise, 2, MADV_NORMAL),
 # ifdef MADV_FREE