nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-10 05:03:43 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'tor-gitlab/mr/714' into maint-0.4.7

Browse Source
This commit is contained in:
David Goulet 2023-05-31 14:28:44 -04:00
commit d77f1e7aea
2 changed files with 18 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
.gitlab-ci.yml
View File

@ -49,6 +49,7 @@ variables:
echo Etc/UTC > /etc/timezone
mkdir -p apt-cache
export APT_CACHE_DIR="$(pwd)/apt-cache"
rm -f /etc/apt/apt.conf.d/docker-clean
echo 'quiet "1";' \
'APT::Install-Recommends "0";' \
'APT::Install-Suggests "0";' \
@ -79,9 +80,11 @@ variables:
- *apt-template
# Install patches unconditionally.
- apt-get install
apt-utils
automake
build-essential
ca-certificates
file
git
libevent-dev
liblzma-dev
@ -106,7 +109,7 @@ variables:
# Minimal check on debian: just make, make check.
#
debian-minimal:
image: debian:buster
image: debian:bullseye
<<: *debian-template
script:
- ./scripts/ci/ci-driver.sh
@ -114,7 +117,7 @@ debian-minimal:
# Minmal check on debian/i386: just make, make check.
#
debian-i386-minimal:
image: i386/debian:buster
image: i386/debian:bullseye
<<: *debian-template
script:
- ./scripts/ci/ci-driver.sh
@ -137,7 +140,7 @@ debian-hardened:
#####
# Distcheck on debian stable
debian-distcheck:
image: debian:buster
image: debian:bullseye
<<: *debian-template
variables:
DISTCHECK: "yes"
@ -148,7 +151,7 @@ debian-distcheck:
#####
# Documentation tests on debian stable: doxygen and asciidoc.
debian-docs:
image: debian:buster
image: debian:bullseye
<<: *debian-template
variables:
DOXYGEN: "yes"
@ -166,7 +169,7 @@ debian-docs:
# with the 'artifacts' mechanism, in theory, but it would be good to
# avoid having to have a system with hundreds of artifacts.
debian-integration:
image: debian:buster
image: debian:bullseye
<<: *debian-template
variables:
CHECK: "no"
@ -180,7 +183,7 @@ debian-integration:
#####
# Tracing build on Debian stable.
debian-tracing:
image: debian:buster
image: debian:bullseye
<<: *debian-template
variables:
TRACING: "yes"
@ -192,7 +195,7 @@ debian-tracing:
#####
# No-authority mode
debian-disable-dirauth:
image: debian:buster
image: debian:bullseye
<<: *debian-template
variables:
DISABLE_DIRAUTH: "yes"
@ -202,7 +205,7 @@ debian-disable-dirauth:
#####
# No-relay mode
debian-disable-relay:
image: debian:buster
image: debian:bullseye
<<: *debian-template
variables:
DISABLE_RELAY: "yes"
@ -212,7 +215,7 @@ debian-disable-relay:
#####
# NSS check on debian
debian-nss:
image: debian:buster
image: debian:bullseye
<<: *debian-template
variables:
NSS: "yes"

7
src/lib/sandbox/sandbox.c
View File

@ -220,6 +220,10 @@ static int filter_nopar_gen[] = {
#endif
// glob uses this..
SCMP_SYS(lstat),
#ifdef __NR_membarrier
/* Inter-processor synchronization, needed for tracing support */
SCMP_SYS(membarrier),
#endif
SCMP_SYS(mkdir),
SCMP_SYS(mlockall),
#ifdef __NR_mmap
@ -1165,7 +1169,8 @@ sb_rt_sigprocmask(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
int rc = 0;
(void) filter;
#ifdef ENABLE_FRAGILE_HARDENING
#if defined(ENABLE_FRAGILE_HARDENING) || \
defined(USE_TRACING_INSTRUMENTATION_LTTNG)
rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(rt_sigprocmask),
SCMP_CMP(0, SCMP_CMP_EQ, SIG_BLOCK));
if (rc)