nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-24 04:13:28 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix crash when tor is compiled with NSS and seccomp sandbox is enabled

Browse Source 
Adds seccomp rules for socket and getpeername used by NSS
This commit is contained in:
Daniel Pinto 2020-05-06 22:00:50 +01:00 committed by Nick Mathewson
parent dd795fbee4
commit 2913dbd6d9
2 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
changes/bug34130 Normal file
View File

@ -0,0 +1,4 @@
o Minor bugfixes (linux seccomp sandbox nss):
- Fix startup crash when tor is compiled with --enable-nss and
sandbox support is enabled. Fixes bug 34130; bugfix on
0.3.5.1-alpha. Patch by Daniel Pinto.

14
src/lib/sandbox/sandbox.c
View File

@ -265,6 +265,11 @@ static int filter_nopar_gen[] = {
SCMP_SYS(listen), SCMP_SYS(listen),
SCMP_SYS(connect), SCMP_SYS(connect),
SCMP_SYS(getsockname), SCMP_SYS(getsockname),
#ifdef ENABLE_NSS
#ifdef __NR_getpeername
SCMP_SYS(getpeername),
#endif
#endif
SCMP_SYS(recvmsg), SCMP_SYS(recvmsg),
SCMP_SYS(recvfrom), SCMP_SYS(recvfrom),
SCMP_SYS(sendto), SCMP_SYS(sendto),
@ -647,6 +652,15 @@ sb_socket(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
} }
} }
#ifdef ENABLE_NSS
rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket),
SCMP_CMP(0, SCMP_CMP_EQ, PF_INET),
SCMP_CMP(1, SCMP_CMP_EQ, SOCK_STREAM),
SCMP_CMP(2, SCMP_CMP_EQ, IPPROTO_IP));
if (rc)
return rc;
#endif
rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket),
SCMP_CMP(0, SCMP_CMP_EQ, PF_UNIX), SCMP_CMP(0, SCMP_CMP_EQ, PF_UNIX),
SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, SOCK_STREAM), SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, SOCK_STREAM),