nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-24 12:23:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

sched: Add sandbox support for KIST

Browse Source 
Signed-off-by: David Goulet <dgoulet@torproject.org>
This commit is contained in:
David Goulet 2017-09-07 15:22:05 -04:00
parent a06f2a0509
commit 6e598bbcd8
1 changed files with 33 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
src/common/sandbox.c
View File

@ -653,6 +653,25 @@ sb_socketpair(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
return 0;
}
#ifdef HAVE_KIST_SUPPORT
#include <linux/sockios.h>
static int
sb_ioctl(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
{
int rc;
(void) filter;
rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(ioctl),
SCMP_CMP(1, SCMP_CMP_EQ, SIOCOUTQNSD));
if (rc)
return rc;
return 0;
}
#endif /* HAVE_KIST_SUPPORT */
/**
* Function responsible for setting up the setsockopt syscall for
* the seccomp filter sandbox.
@ -760,6 +779,15 @@ sb_getsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
return rc;
#endif
#ifdef HAVE_KIST_SUPPORT
#include <netinet/tcp.h>
rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt),
SCMP_CMP(1, SCMP_CMP_EQ, SOL_TCP),
SCMP_CMP(2, SCMP_CMP_EQ, TCP_INFO));
if (rc)
return rc;
#endif
return 0;
}
@ -1060,7 +1088,11 @@ static sandbox_filter_func_t filter_func[] = {
sb_socket,
sb_setsockopt,
sb_getsockopt,
sb_socketpair
sb_socketpair,
#ifdef HAVE_KIST_SUPPORT
sb_ioctl,
#endif
};
const char *