#1007714 bullseye-pu: package openssh/1:8.4p1-5+deb11u1

Package:
release.debian.org
Source:
release.debian.org
Submitter:
Colin Watson
Date:
2022-07-09 10:51:32 UTC
Severity:
normal
Tags:
#1007714#5
Date:
2022-03-15 15:20:49 UTC
From:
To:
(Please provide enough information to help the release team
to judge the request efficiently. E.g. by filling in the
sections below.)

[ Reason ]
OpenSSH in stable breaks on 32-bit architectures (at least armhf,
reportedly also i386) after upgrading libc6 to the version in bookworm,
due to changes in its system call interface that affect OpenSSH's
seccomp sandbox.  See https://bugs.debian.org/1004427.

[ Impact ]
Without this change, I'm concerned that sshd may be unavailable during
part of an upgrade from bullseye to bookworm (or even make the machine
inaccessible, if it's headless and the upgrade fails).  Getting the
sandbox tweak into bullseye at this stage would reduce that risk.

[ Tests ]
Existing autopkgtests are quite comprehensive and ensure that normal
connections to sshd continue to work.  They don't cover the case of
upgrading to bookworm's libc6 and restarting sshd; that would need to be
done manually.

[ Risks ]
I think the only real risk here is the usual residual misbuild risk from
any update, which autopkgtests would catch.  The actual code change just
adds another allow rule to a seccomp filter.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable (modulo
      finalizing the changelog)
  [x] the issue is verified as fixed in unstable (fixed upstream as of
      OpenSSH 8.5p1, which has been in unstable since November)

[ Changes ]
An extra SC_ALLOW(__NR_pselect6_time64) if that syscall is defined.
#1007714#10
Date:
2022-03-17 22:00:13 UTC
From:
To:
Control: tags -1 + confirmed d-i

Please go ahead.

As openssh builds a udeb, I'm CCing KiBi and tagging the bug
accordingly.

Regards,

Adam
#1007714#17
Date:
2022-03-18 07:43:33 UTC
From:
To:
Adam D. Barratt <adam@adam-barratt.org.uk> (2022-03-17):

Making sure upgrades have a chance to work properly seems more important
than any possible regressions at install time, for those deploying over
SSH, so no objections at all.


Cheers,
#1007714#22
Date:
2022-06-29 21:27:01 UTC
From:
To:
Hi Colin,

Just a quick reminder on this, as the window for getting changes into
11.4 closes over the coming weekend.

Regards,

Adam
#1007714#27
Date:
2022-07-01 22:40:00 UTC
From:
To:
Oops, sorry!  I've just uploaded this.
#1007714#32
Date:
2022-07-02 17:16:33 UTC
From:
To:
package release.debian.org
tags 1007714 = bullseye pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bullseye.

Thanks for your contribution!

Upload details
==============

Package: openssh
Version: 8.4p1-5+deb11u1

Explanation: seccomp: add pselect6_time64 syscall on 32-bit architectures
#1007714#37
Date:
2022-07-02 17:16:33 UTC
From:
To:
package release.debian.org
tags 1007714 = bullseye pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bullseye.

Thanks for your contribution!

Upload details
==============

Package: openssh
Version: 8.4p1-5+deb11u1

Explanation: seccomp: add pselect6_time64 syscall on 32-bit architectures
#1007714#42
Date:
2022-07-09 10:47:43 UTC
From:
To:
(re-sending with fixed bug numbers)

Hi,

The updates discussed in these bugs were included in today's bullseye
point release.

Regards,

Adam