4 files changed, 37 insertions, 1 deletions
diff --git a/net-vpn/Manifest.gz b/net-vpn/Manifest.gz
index 583b685a00c3..b2b1fc941126 100644
--- a/net-vpn/Manifest.gz
+++ b/net-vpn/Manifest.gz
diff --git a/net-vpn/ocserv/Manifest b/net-vpn/ocserv/Manifest
index e8a3d243e763..59721f55711a 100644
--- a/net-vpn/ocserv/Manifest
+++ b/net-vpn/ocserv/Manifest
@@ -1,4 +1,5 @@
 AUX ocserv 182 BLAKE2B b7ea6c381fed7406bda8fae3638445d6cd2e2acaf5f5c310227fc56f62e3286df6bb49063db8d2ab8dce2c6d5e8487b50085875f2af057b662aeb37b5adfe77a SHA512 9e0dcc3668e5e7584b4f01f56c0b48c7a1099b3658ee2387cd899050030328c497e64f9409a1af589ab42f8b6b1e7f13828a50b478906721ccad9d3013f3b06a
+AUX ocserv-1.3.0-seccomp-readlinkat.patch 985 BLAKE2B 77b8cb5b4c13d25d37fe62c632579ef479f68c27854ed0cbf5762b351819ee5ed3a59066ee93167ca688ee4e126f4bbbd79de2a78808d833a8e1bffb79b2ab5e SHA512 2a1099b8e5cb9707f94afefd75aa0eab8125e1b9a30ac0e6ca1903c33cdbdbb32c60036763b15f89806d7d9114f228b5c2364004d3f9101cced6d5463516d20b
 DIST ocserv-1.1.6.tar.xz 839744 BLAKE2B 3b3591588d9a5be4e723df739a5d8b4c33d78d536ecb169263c83cf8bedfdaab1a3d06e6dc11544acbede135626d37d98f2bc26b95ff80abb3f0e99f4688b7f6 SHA512 d1c5e5cf0e84aab168ed51516534df8b2968194dd1421f33563c61b3e47d5d79ebe9e6ffbf7cbcc9ff1242fae05151024f70ef586d063bec0b3eec00050bfdfa
 DIST ocserv-1.1.6.tar.xz.sig 442 BLAKE2B d24c46783f273bd329267cb3ba4effe0280655867e619bf0a3e4191386fa8851541fcd8768b0b1068e594caaf510ceeccfc30641169679ec394706fdf1ebe319 SHA512 2a87768ad63d40053732fa011bbeb3532c9673296b9be299bf8f7d8dd3dd35571eee96c0b4fa9bf5a30633b4c844337ab3d562d6ea2b6ad8efca084eb5e6f502
 DIST ocserv-1.1.7.tar.xz 844140 BLAKE2B 0b89937ce74fcf83d6423458462b3a419f9604407c80e2fc4a732b3e481dfd98cc76f062e112bf93ee392b3f4cdf5fdd271997c878bbe4165f11fa282852ff90 SHA512 5b6182b98c0406a27dae7121ec0d8771b158e0d8ce2056bd35451c8ed087a8b7f7d40035f9db5c19aa9a9a3b2c6b07be8f0bad4b6b96569584815a5358202ba4
@@ -7,6 +8,6 @@ DIST ocserv-1.3.0.tar.xz 770596 BLAKE2B b45c528ca0d12602ae05cebf469a4be2efa846a4
 DIST ocserv-1.3.0.tar.xz.sig 442 BLAKE2B f73b98c71a0c3fe18bf540e84871a51d28b8993ba9ae719f89fa345412a609d062b2041cd9b0e4b6aae8eecf8a117c68d408153b0ea15c7b1277f3d2ebcec567 SHA512 dd6a2e6f28a512bda19e758b32149cfe7951151edab8c34ac371dbcd17eed4a8b10fdfee306629c1d42c2a3e22bcfe523ee2aafb84d59181d5be719c399cfb7d
 EBUILD ocserv-1.1.6.ebuild 2205 BLAKE2B ee79d90e9277d6fdba6e090f91203fec92642e1c216bcdc9f920209fe4e4f3a494f054b3a39d6c87789492703f819fc3d2ccfe9ee3951acfdfa5fa8226af5e07 SHA512 ed2063b5059198983b045524b774d3701f5c460c4401ddf3219d6ff4f3e982a0bfdc0540913c505a2997dbadb74baa3d7b758ceaf892b852472581796a8c8b18
 EBUILD ocserv-1.1.7.ebuild 2235 BLAKE2B c326b55e1c51469107c3b96f3d49dc61a53288211bbc64a3fa3131beef35d5b817cf96923a118db56156a2e9ca74ec5d4e3b4687fae6cfb83c8e21be6bce0bcc SHA512 f0844cfa90cf0a22d0ad566f55de32cff0a73549c2f0467be457be7501252201bc879a33431a6b09418fc60543e8e9c77a35742461a39890b22fe14494cf4094
-EBUILD ocserv-1.3.0.ebuild 2233 BLAKE2B f531983998dbcd7921f61e03da69a19f6b7722c7f817e0d4abe6f9a655c7cf718ff0876007a7fa717e0750d851a568d76bd24ab61458bf0c153c1728cb6dbae1 SHA512 a209addcdf401c1b9851332e65a40361b408b88506e294b6fb11e6999d4fc90c0ed632c14698a9723b12fbd94eda7452d57222a560b407ff675ba0d18ab5ca14
+EBUILD ocserv-1.3.0-r1.ebuild 2299 BLAKE2B 35967412b941bc00e5f6d2aa6223182669116adba093153a3e4612150dd2c8da721ef7b1063effda2658fb418cf0a3917fef7b60d308334331dbfd95610522b2 SHA512 d10d75404209bbe5111b066a8e54c567713ff6db837f4c7cba2a322012a7861971fa9d267aeef958ac1adcd1dec2cdbd809d349a1e9e228c285e9a913c3b8004
 EBUILD ocserv-9999.ebuild 2237 BLAKE2B 349fe0596b22f605453efc72d2c5a2e9bd4d392107b0d96ebe4bd92ec225fc50da8b2c52b7a7ed78bbe07e2642c06889a34d3a8e24af42c75d18b3f2fd240c6e SHA512 1b457d8f5bec7eabdcee30ee7eaa520a3b559c44ce5e423f134475303fcc1753f3f89cc06a054fa73354f2b66c93b2768e893f8a9f3704b13e22bac27e081d82
 MISC metadata.xml 326 BLAKE2B 72d04a451a052190079aaceb838f59191053f6c62bc8b39cc6d914f2b6f1083e6192235865d1ac9afd2569fb71441db028534abbf74666ccf063be2fd55522d0 SHA512 2a0ad00196df1cf38f02bf6de7232ac6d8886a85592c712e255bc4f7ec100ec1712c22f29f52c7b9b6c1d8f7473c5a4ab94e1f0e74c6eca0aa4563c3597a1798
diff --git a/net-vpn/ocserv/files/ocserv-1.3.0-seccomp-readlinkat.patch b/net-vpn/ocserv/files/ocserv-1.3.0-seccomp-readlinkat.patch
new file mode 100644
index 000000000000..e26e93140ccc
--- /dev/null
+++ b/net-vpn/ocserv/files/ocserv-1.3.0-seccomp-readlinkat.patch
@@ -0,0 +1,31 @@
+https://gitlab.com/openconnect/ocserv/-/merge_requests/444
+https://bugs.gentoo.org/942899
+
+From e58139e49752dffb6983b3ccc5455d612912dd66 Mon Sep 17 00:00:00 2001
+From: Mike Gilbert <floppym@gentoo.org>
+Date: Wed, 6 Nov 2024 13:53:51 -0500
+Subject: [PATCH] Allow the readlinkat syscall when socket_wrapper is in use
+
+On arm64, the realpath function calls readlinkat instead of readlink.
+
+Fixes: https://gitlab.com/openconnect/ocserv/-/issues/627
+Signed-off-by: Mike Gilbert <floppym@gentoo.org>
+---
+ src/worker-privs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/worker-privs.c b/src/worker-privs.c
+index 54985999b..6e0762780 100644
+--- a/src/worker-privs.c
++++ b/src/worker-privs.c
+@@ -105,6 +105,7 @@ int disable_system_calls(struct worker_st *ws)
+ 	 * them when socket wrapper is active */
+ 	if (getenv("SOCKET_WRAPPER_DIR") != NULL) {
+ 		ADD_SYSCALL(readlink, 0);
++		ADD_SYSCALL(readlinkat, 0);
+ 	}
+ 
+ 	/* we use quite some system calls here, and in the end
+-- 
+GitLab
+
diff --git a/net-vpn/ocserv/ocserv-1.3.0.ebuild b/net-vpn/ocserv/ocserv-1.3.0-r1.ebuild
index c354d7bae7ad..ddfef2cd45cc 100644
--- a/net-vpn/ocserv/ocserv-1.3.0.ebuild
+++ b/net-vpn/ocserv/ocserv-1.3.0-r1.ebuild
@@ -59,6 +59,10 @@ DEPEND="
 "
 RDEPEND="${DEPEND}"
 
+PATCHES=(
+	"${FILESDIR}"/ocserv-1.3.0-seccomp-readlinkat.patch
+)
+
 src_prepare() {
 	default
 	if [[ ${PV} == 9999 ]]; then