nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-30 23:53:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

added experimental support for open syscall path param

Browse Source
This commit is contained in:
Cristian Toader 2013-07-23 14:01:53 +03:00
parent 8b12170f23
commit c15d09293b
4 changed files with 36 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/common/compat.c
View File

@ -125,6 +125,7 @@ tor_open_cloexec(const char *path, int flags, unsigned mode)
{ {
int fd; int fd;
#ifdef O_CLOEXEC #ifdef O_CLOEXEC
path = get_prot_param(path);
fd = open(path, flags|O_CLOEXEC, mode); fd = open(path, flags|O_CLOEXEC, mode);
if (fd >= 0) if (fd >= 0)
return fd; return fd;

39
src/common/sandbox.c
View File

@ -46,7 +46,34 @@ static ParFilter param_filter[] = {
{SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGXFSZ), 0}, {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGXFSZ), 0},
#endif #endif
{SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGCHLD), 0}, {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGCHLD), 0},
{SCMP_SYS(open), PARAM_PTR,
(intptr_t)("/home/cristi/.tor/cached-certs"), 0},
{SCMP_SYS(open), PARAM_PTR,
(intptr_t)("/home/cristi/.tor/cached-consensus"), 0},
{SCMP_SYS(open), PARAM_PTR,
(intptr_t)("/home/cristi/.tor/unverified-consensus"), 0},
{SCMP_SYS(open), PARAM_PTR,
(intptr_t)("/home/cristi/.tor/cached-microdesc-consensus"), 0},
{SCMP_SYS(open), PARAM_PTR,
(intptr_t)("/home/cristi/.tor/cached-microdesc-consensus.tmp"), 0},
{SCMP_SYS(open), PARAM_PTR,
(intptr_t)("/home/cristi/.tor/cached-microdescs"), 0},
{SCMP_SYS(open), PARAM_PTR,
(intptr_t)("/home/cristi/.tor/cached-microdescs.new"), 0},
{SCMP_SYS(open), PARAM_PTR,
(intptr_t)("/home/cristi/.tor/unverified-microdesc-consensus"), 0},
{SCMP_SYS(open), PARAM_PTR,
(intptr_t)("/home/cristi/.tor/cached-descriptors"), 0},
{SCMP_SYS(open), PARAM_PTR,
(intptr_t)("/home/cristi/.tor/cached-descriptors.new"), 0},
{SCMP_SYS(open), PARAM_PTR,
(intptr_t)("/home/cristi/.tor/cached-extrainfo"), 0},
{SCMP_SYS(open), PARAM_PTR,
(intptr_t)("/home/cristi/.tor/state.tmp"), 0},
{SCMP_SYS(open), PARAM_PTR,
(intptr_t)("/home/cristi/.tor/unparseable-desc.tmp"), 0},
{SCMP_SYS(open), PARAM_PTR,
(intptr_t)("/home/cristi/.tor/unparseable-desc"), 0},
}; };
/** Variable used for storing all syscall numbers that will be allowed with the /** Variable used for storing all syscall numbers that will be allowed with the
@ -106,7 +133,6 @@ static int general_filter[] = {
SCMP_SYS(mprotect), SCMP_SYS(mprotect),
SCMP_SYS(mremap), SCMP_SYS(mremap),
SCMP_SYS(munmap), SCMP_SYS(munmap),
SCMP_SYS(open),
SCMP_SYS(openat), SCMP_SYS(openat),
SCMP_SYS(poll), SCMP_SYS(poll),
SCMP_SYS(prctl), SCMP_SYS(prctl),
@ -175,13 +201,14 @@ get_prot_param(char *param)
} }
for (i = 0; i < filter_size; i++) { for (i = 0; i < filter_size; i++) {
if (param_filter[i].prot && !strncmp(param, (char*) param_filter[i].param, if (param_filter[i].prot && param_filter[i].ptype == PARAM_PTR
MAX_PARAM_LEN) && param_filter[i].ptype == PARAM_PTR) { && !strncmp(param, (char*)(param_filter[i].param), MAX_PARAM_LEN)) {
return (char*)(param_filter[i].param); return (char*)(param_filter[i].param);
} }
} }
return NULL; log_warn(LD_BUG, "(Sandbox) Parameter %s not found", param);
return param;
} }
static int static int
@ -213,7 +240,7 @@ add_param_filter(scmp_filter_ctx ctx)
} }
// copying from non protected to protected + pointer reassign // copying from non protected to protected + pointer reassign
memcpy(map, (char*) param_filter[i].param, param_size); memcpy(map, (char*) (param_filter[i].param), param_size);
param_filter[i].param = (intptr_t) map; param_filter[i].param = (intptr_t) map;
// protecting from writes // protecting from writes

2
src/common/sandbox.h
View File

@ -32,7 +32,7 @@
#define __USE_GNU #define __USE_GNU
#include <sys/ucontext.h> #include <sys/ucontext.h>
#define MAX_PARAM_LEN 32 #define MAX_PARAM_LEN 64
#define PARAM_PTR 0 #define PARAM_PTR 0
#define PARAM_NUM 1 #define PARAM_NUM 1

2
src/or/routerlist.c
View File

@ -37,7 +37,7 @@
#include "routerlist.h" #include "routerlist.h"
#include "routerparse.h" #include "routerparse.h"
#include "routerset.h" #include "routerset.h"
#include "../common/sandbox.h"
// #define DEBUG_ROUTERLIST // #define DEBUG_ROUTERLIST
/****************************************************************************/ /****************************************************************************/