nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-10 21:23:58 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'maint-0.2.8'

Browse Source
This commit is contained in:
Nick Mathewson 2016-07-13 09:19:35 -04:00
commit 9932544297
2 changed files with 27 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
changes/bug18397 Normal file
View File

@ -0,0 +1,7 @@
o Minor bugfixes (Linux seccomp2 sandbox):
- Add a few missing syscalls to the seccomp2 sandbox: sysinfo,
getsockopt(SO_SNDBUF), and setsockopt(SO_SNDBUFFORCE). On
some systems, these are required for Tor to start with
"Sandbox 1" enabled.
Fixes bug 18397; bugfix on 0.2.5.1-alpha. Patch from
Daniel Pinto.

20
src/common/sandbox.c
View File

@ -210,6 +210,10 @@ static int filter_nopar_gen[] = {
SCMP_SYS(getrandom),
#endif
#ifdef __NR_sysinfo
// qsort uses this..
SCMP_SYS(sysinfo),
#endif
/*
* These socket syscalls are not required on x86_64 and not supported with
* some libseccomp versions (eg: 1.0.1)
@ -699,6 +703,14 @@ sb_setsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
if (rc)
return rc;
#ifdef HAVE_SYSTEMD
rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt),
SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET),
SCMP_CMP(2, SCMP_CMP_EQ, SO_SNDBUFFORCE));
if (rc)
return rc;
#endif
#ifdef IP_TRANSPARENT
rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt),
SCMP_CMP(1, SCMP_CMP_EQ, SOL_IP),
@ -732,6 +744,14 @@ sb_getsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
if (rc)
return rc;
#ifdef HAVE_SYSTEMD
rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt),
SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET),
SCMP_CMP(2, SCMP_CMP_EQ, SO_SNDBUF));
if (rc)
return rc;
#endif
#ifdef HAVE_LINUX_NETFILTER_IPV4_H
rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt),
SCMP_CMP(1, SCMP_CMP_EQ, SOL_IP),