nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-12-01 08:03:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

small filter changes; openat as separate function

Browse Source
This commit is contained in:
Cristian Toader 2013-07-30 19:09:28 +03:00
parent 8022def6f0
commit 871e5b35a8
3 changed files with 22 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
src/common/sandbox.c
View File

@ -26,17 +26,21 @@
#if defined(USE_LIBSECCOMP) #if defined(USE_LIBSECCOMP)
#define _GNU_SOURCE
#include <sys/mman.h> #include <sys/mman.h>
#include <sys/syscall.h> #include <sys/syscall.h>
#include <sys/types.h>
#include <bits/signum.h> #include <bits/signum.h>
#include <seccomp.h> #include <seccomp.h>
#include <signal.h> #include <signal.h>
#include <unistd.h> #include <unistd.h>
#include <fcntl.h>
sandbox_cfg_t *filter_dynamic = NULL; sandbox_cfg_t *filter_dynamic = NULL;
static sandbox_static_cfg_t filter_static[] = { static sandbox_static_cfg_t filter_static[] = {
// Example entries
{SCMP_SYS(execve), PARAM_PTR, 0, (intptr_t)("/usr/local/bin/tor"), 0}, {SCMP_SYS(execve), PARAM_PTR, 0, (intptr_t)("/usr/local/bin/tor"), 0},
{SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGINT), 0}, {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGINT), 0},
{SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGTERM), 0}, {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGTERM), 0},
@ -49,19 +53,16 @@ static sandbox_static_cfg_t filter_static[] = {
#endif #endif
{SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGCHLD), 0}, {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGCHLD), 0},
{SCMP_SYS(time), PARAM_NUM, 0, 0, 0}, {SCMP_SYS(time), PARAM_NUM, 0, 0, 0},
// accept4 workaround
#ifdef __NR_socketcall #ifdef __NR_socketcall
{SCMP_SYS(socketcall), PARAM_NUM, 0, 18, 0}, // accept4 workaround {SCMP_SYS(socketcall), PARAM_NUM, 0, 18, 0},
#endif #endif
{SCMP_SYS(open), PARAM_NUM, 1, O_RDONLY | O_CLOEXEC, 0}
}; };
/** Variable used for storing all syscall numbers that will be allowed with the /** Variable used for storing all syscall numbers that will be allowed with the
* stage 1 general Tor sandbox. * stage 1 general Tor sandbox.
*
* todo:
* read, write, close - rely on fd
*
*
*/ */
static int filter_nopar_gen[] = { static int filter_nopar_gen[] = {
SCMP_SYS(access), SCMP_SYS(access),
@ -72,7 +73,6 @@ static int filter_nopar_gen[] = {
SCMP_SYS(epoll_create), SCMP_SYS(epoll_create),
SCMP_SYS(epoll_ctl), SCMP_SYS(epoll_ctl),
SCMP_SYS(epoll_wait), SCMP_SYS(epoll_wait),
SCMP_SYS(execve),
SCMP_SYS(fcntl), SCMP_SYS(fcntl),
#ifdef __NR_fcntl64 #ifdef __NR_fcntl64
/* Older libseccomp versions don't define PNR entries for all of these, /* Older libseccomp versions don't define PNR entries for all of these,
@ -228,23 +228,29 @@ int
sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file) sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file)
{ {
sandbox_cfg_t *elem = NULL; sandbox_cfg_t *elem = NULL;
intptr_t prot_str = (intptr_t) prot_strdup((char*) file);
elem = (sandbox_cfg_t*) malloc(sizeof(sandbox_cfg_t)); elem = (sandbox_cfg_t*) malloc(sizeof(sandbox_cfg_t));
elem->syscall = SCMP_SYS(open); elem->syscall = SCMP_SYS(open);
elem->pindex = 0; elem->pindex = 0;
elem->ptype = PARAM_PTR; elem->ptype = PARAM_PTR;
elem->param = prot_str; elem->param = (intptr_t) prot_strdup((char*) file);
elem->prot = 1; elem->prot = 1;
elem->next = filter_dynamic; elem->next = filter_dynamic;
filter_dynamic = elem; filter_dynamic = elem;
// also allow openat return 0;
}
int
sandbox_cfg_allow_openat_filename(sandbox_cfg_t **cfg, char *file)
{
sandbox_cfg_t *elem = NULL;
elem = (sandbox_cfg_t*) malloc(sizeof(sandbox_cfg_t)); elem = (sandbox_cfg_t*) malloc(sizeof(sandbox_cfg_t));
elem->syscall = SCMP_SYS(openat); elem->syscall = SCMP_SYS(openat);
elem->pindex = 1; elem->pindex = 1;
elem->ptype = PARAM_PTR; elem->ptype = PARAM_PTR;
elem->param = prot_str; elem->param = (intptr_t) prot_strdup((char*) file);;
elem->prot = 1; elem->prot = 1;
elem->next = filter_dynamic; elem->next = filter_dynamic;
filter_dynamic = elem; filter_dynamic = elem;

1
src/common/sandbox.h
View File

@ -86,6 +86,7 @@ const char* sandbox_intern_string(const char *param);
sandbox_cfg_t * sandbox_cfg_new(); sandbox_cfg_t * sandbox_cfg_new();
int sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file); int sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file);
int sandbox_cfg_allow_openat_filename(sandbox_cfg_t **cfg, char *file);
int sandbox_init(sandbox_cfg_t* cfg); int sandbox_init(sandbox_cfg_t* cfg);
#endif /* SANDBOX_H_ */ #endif /* SANDBOX_H_ */

3
src/or/main.c
View File

@ -2644,8 +2644,9 @@ sandbox_init_filter()
{ {
sandbox_cfg_t *cfg = sandbox_cfg_new(); sandbox_cfg_t *cfg = sandbox_cfg_new();
sandbox_cfg_allow_open_filename(&cfg, sandbox_cfg_allow_openat_filename(&cfg,
get_datadir_fname("cached-status")); get_datadir_fname("cached-status"));
sandbox_cfg_allow_open_filename(&cfg, sandbox_cfg_allow_open_filename(&cfg,
get_datadir_fname("cached-certs")); get_datadir_fname("cached-certs"));
sandbox_cfg_allow_open_filename(&cfg, sandbox_cfg_allow_open_filename(&cfg,