nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-14 07:03:44 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'bug11622'

Browse Source
This commit is contained in:
Nick Mathewson 2014-05-27 17:35:04 -04:00
commit ba9946dda7
3 changed files with 37 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
changes/11622 Normal file
View File

@ -0,0 +1,3 @@
o Minor bugfixes (linux seccomp sandbox)
- Make the seccomp sandbox code compile with ARM linux. Fixes bug
11622; bugfix on 0.2.5.1-alpha.

36
src/common/sandbox.c
View File

@ -67,6 +67,28 @@
#include <execinfo.h> #include <execinfo.h>
#endif #endif
/**
* Linux 32 bit definitions
*/
#if defined(__i386__)
#define REG_SYSCALL REG_EAX
#define M_SYSCALL gregs[REG_SYSCALL]
/**
* Linux 64 bit definitions
*/
#elif defined(__x86_64__)
#define REG_SYSCALL REG_RAX
#define M_SYSCALL gregs[REG_SYSCALL]
#elif defined(__arm__)
#define M_SYSCALL arm_r7
#endif
/**Determines if at least one sandbox is active.*/ /**Determines if at least one sandbox is active.*/
static int sandbox_active = 0; static int sandbox_active = 0;
/** Holds the parameter list configuration for the sandbox.*/ /** Holds the parameter list configuration for the sandbox.*/
@ -113,7 +135,9 @@ static int filter_nopar_gen[] = {
#ifdef __NR_getgid32 #ifdef __NR_getgid32
SCMP_SYS(getgid32), SCMP_SYS(getgid32),
#endif #endif
#ifdef __NR_getrlimt
SCMP_SYS(getrlimit), SCMP_SYS(getrlimit),
#endif
SCMP_SYS(gettimeofday), SCMP_SYS(gettimeofday),
SCMP_SYS(gettid), SCMP_SYS(gettid),
SCMP_SYS(getuid), SCMP_SYS(getuid),
@ -126,7 +150,10 @@ static int filter_nopar_gen[] = {
#endif #endif
SCMP_SYS(mkdir), SCMP_SYS(mkdir),
SCMP_SYS(mlockall), SCMP_SYS(mlockall),
#ifdef __NR_mmap
/* XXXX restrict this in the same ways as mmap2 */
SCMP_SYS(mmap), SCMP_SYS(mmap),
#endif
SCMP_SYS(munmap), SCMP_SYS(munmap),
SCMP_SYS(read), SCMP_SYS(read),
SCMP_SYS(rt_sigreturn), SCMP_SYS(rt_sigreturn),
@ -245,8 +272,12 @@ static int
sb_time(scmp_filter_ctx ctx, sandbox_cfg_t *filter) sb_time(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
{ {
(void) filter; (void) filter;
#ifdef __NR_time
return seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(time), return seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(time),
SCMP_CMP(0, SCMP_CMP_EQ, 0)); SCMP_CMP(0, SCMP_CMP_EQ, 0));
#else
return 0;
#endif
} }
/** /**
@ -1439,7 +1470,8 @@ install_syscall_filter(sandbox_cfg_t* cfg)
// loading the seccomp2 filter // loading the seccomp2 filter
if ((rc = seccomp_load(ctx))) { if ((rc = seccomp_load(ctx))) {
log_err(LD_BUG, "(Sandbox) failed to load!"); log_err(LD_BUG, "(Sandbox) failed to load: %d (%s)!", rc,
strerror(-rc));
goto end; goto end;
} }
@ -1499,7 +1531,7 @@ sigsys_debugging(int nr, siginfo_t *info, void *void_context)
if (!ctx) if (!ctx)
return; return;
syscall = (int) ctx->uc_mcontext.gregs[REG_SYSCALL]; syscall = (int) ctx->uc_mcontext.M_SYSCALL;
#ifdef USE_BACKTRACE #ifdef USE_BACKTRACE
depth = backtrace(syscall_cb_buf, MAX_DEPTH); depth = backtrace(syscall_cb_buf, MAX_DEPTH);

16
src/common/sandbox.h
View File

@ -119,22 +119,6 @@ typedef struct {
sandbox_cfg_t *filter_dynamic; sandbox_cfg_t *filter_dynamic;
} sandbox_t; } sandbox_t;
/**
* Linux 32 bit definitions
*/
#if defined(__i386__)
#define REG_SYSCALL REG_EAX
/**
* Linux 64 bit definitions
*/
#elif defined(__x86_64__)
#define REG_SYSCALL REG_RAX
#endif
#endif // USE_LIBSECCOMP #endif // USE_LIBSECCOMP
#ifdef USE_LIBSECCOMP #ifdef USE_LIBSECCOMP