wireguard-openbsd - WireGuard implementation for the OpenBSD kernel

	Commit message (Collapse)	Author	Age	Files	Lines
*	use the new variant log macros instead of prepending __func__ and	djm	2020-10-18	1	-9/+9
\| \| \| \|	appending ssh_err(r) manually; ok markus@
*	Add MAXIMUM(), MINIMUM(), and ROUNDUP() to misc.h, then use those definitions	deraadt	2016-09-12	1	-2/+1
\| \| \| \| \|	rather than pulling <sys/param.h> and unknown namespace pollution. ok djm markus dtucker
*	rename sandbox.h => ssh-sandbox.h to make things easier for portable	djm	2011-06-23	1	-2/+2
\|
*	$OpenBSD$ makers	djm	2011-06-22	1	-0/+1
\|
*	introduce sandboxing of the pre-auth privsep child using systrace(4).	djm	2011-06-22	1	-0/+86
	This introduces a new "UsePrivilegeSeparation=sandbox" option for sshd_config that applies mandatory restrictions on the syscalls the privsep child can perform. This prevents a compromised privsep child from being used to attack other hosts (by opening sockets and proxying) or probing local kernel attack surface. The sandbox is implemented using systrace(4) in unsupervised "fast-path" mode, where a list of permitted syscalls is supplied. Any syscall not on the list results in SIGKILL being sent to the privsep child. Note that this requires a kernel with the new SYSTR_POLICY_KILL option. UsePrivilegeSeparation=sandbox will become the default in the future so please start testing it now. feedback dtucker@; ok markus@