- (djm) [sandbox-seccomp-filter.c sandbox-systrace.c] Allow shutdown(2)

syscall from sandboxes; it may be called by packet_close.

ChangeLog

@@ -1,3 +1,7 @@
+20140131
+ - (djm) [sandbox-seccomp-filter.c sandbox-systrace.c] Allow shutdown(2)
+   syscall from sandboxes; it may be called by packet_close.
+
 20140130
  - (djm) [configure.ac] Only check for width-specified integer types
    in headers that actually exist. patch from Tom G. Christensen;

sandbox-seccomp-filter.c

@@ -98,6 +98,7 @@ static const struct sock_filter preauth_insns[] = {
 	SC_ALLOW(read),
 	SC_ALLOW(write),
 	SC_ALLOW(close),
+	SC_ALLOW(shutdown),
 	SC_ALLOW(brk),
 	SC_ALLOW(poll),
 #ifdef __NR__newselect

sandbox-systrace.c

@@ -66,6 +66,7 @@ static const struct sandbox_policy preauth_policy[] = {
 	{ SYS_munmap, SYSTR_POLICY_PERMIT },
 	{ SYS_read, SYSTR_POLICY_PERMIT },
 	{ SYS_select, SYSTR_POLICY_PERMIT },
+	{ SYS_shutdown, SYSTR_POLICY_PERMIT },
 	{ SYS_sigprocmask, SYSTR_POLICY_PERMIT },
 	{ SYS_write, SYSTR_POLICY_PERMIT },
 	{ -1, -1 }