libseccomp: update to 2.4.0 to fix a security bug (incorrect generation of syscall argument filters)

[stefano-m]

[EDIT] Cc: @grahamc @fpletz @domenkozar (NixOS securiy team https://nixos.org/nixos/security.html)

Issue description

The current version of libseccomp at the time of writing is 2.3.3 for both the 18.09 and unstable channels.

Quoting https://seclists.org/oss-sec/2019/q1/179 (emphasis mine)

libseccomp: incorrect generation of syscall argument filters

Jann Horn (CC'd) identified a problem in current versions of
libseccomp where the library did not correctly generate 64-bit syscall
argument comparisons using the arithmetic operators (LT, GT, LE, GE).
Jann has done a search using codesearch.debian.net and it would appear
that only systemd and Tor are using libseccomp in such a way as to
trigger the bad code. In the case of systemd this appears to affect
the socket address family and scheduling class filters. In the case
of Tor it appears that the bad filters could impact the memory
addresses passed to mprotect(2).

The libseccomp v2.4.0 release fixes this problem, and should be a
direct drop-in replacement for previous v2.x releases. Due the
complexity, and associated risk, of backporting the fix to the v2.3.x
release stream, I've made the difficult decision not to backport the
fix. Further, I'm not aware of any workarounds for this issue.
Adminstrators and distros are strongly encouraged to upgrade to
libseccomp v2.4.0 as soon as possible.

The related GitHub issue, complete with a brief discussion of the
problem and a list of the assocated patches can be found at the link
below:

• BUG: 64-bit argument comparisons do not work correctly (CVE-2019-9893) seccomp/libseccomp#139

The libseccomp v2.4.0 release can be found at the link below:

• https://github.com/seccomp/libseccomp/releases/tag/v2.4.0

Steps to reproduce

N/A

Technical details

• system: "x86_64-linux"
• host os: Linux 4.14.105, NixOS, 18.09.2327.37694c8cc0e (Jellyfish)
• multi-user?: yes
• sandbox: yes
• version: nix-env (Nix) 2.2
• channels(root): "nixos-18.09.2327.37694c8cc0e"
• channels(user): "unstable-19.09pre172038.5d3fd3674a6"
• nixpkgs: /nix/var/nix/profiles/per-user/root/channels/nixos

[xeji]

See #57669

[joachifm]

Seems to me this has been resolved