nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-28 06:13:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

removed access, set_robust_list, set_thread_area, set_tid_address, uname; added sb_poll

Browse Source
This commit is contained in:
Cristian Toader 2013-07-31 12:05:10 +03:00
parent 313cbe6e24
commit dde3ed385b
1 changed files with 24 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
src/common/sandbox.c
View File

@ -43,6 +43,7 @@
#include <unistd.h>
#include <fcntl.h>
#include <time.h>
#include <poll.h>
sandbox_cfg_t *filter_dynamic = NULL;
@ -50,7 +51,6 @@ sandbox_cfg_t *filter_dynamic = NULL;
* stage 1 general Tor sandbox.
*/
static int filter_nopar_gen[] = {
SCMP_SYS(access),
SCMP_SYS(brk),
SCMP_SYS(close),
SCMP_SYS(clone),
@ -88,25 +88,27 @@ static int filter_nopar_gen[] = {
SCMP_SYS(mlockall),
SCMP_SYS(mmap),
SCMP_SYS(munmap),
SCMP_SYS(poll),
SCMP_SYS(read),
SCMP_SYS(rename),
SCMP_SYS(rt_sigreturn),
#ifdef __NR_sigreturn
SCMP_SYS(sigreturn),
#endif
SCMP_SYS(set_robust_list),
SCMP_SYS(set_thread_area),
SCMP_SYS(set_tid_address),
SCMP_SYS(stat),
#ifdef __NR_stat64
SCMP_SYS(stat64),
#endif
SCMP_SYS(uname),
SCMP_SYS(write),
SCMP_SYS(exit_group),
SCMP_SYS(exit),
// Not needed..
// SCMP_SYS(access),
// SCMP_SYS(set_robust_list),
// SCMP_SYS(set_thread_area),
// SCMP_SYS(set_tid_address),
// SCMP_SYS(uname),
// socket syscalls
SCMP_SYS(bind),
SCMP_SYS(connect),
@ -437,6 +439,20 @@ sb_mremap(scmp_filter_ctx ctx)
return 0;
}
static int
sb_poll(scmp_filter_ctx ctx)
{
int rc = 0;
rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(poll), 2,
SCMP_CMP(1, SCMP_CMP_EQ, 1),
SCMP_CMP(2, SCMP_CMP_EQ, 10));
if (rc)
return rc;
return 0;
}
static sandbox_filter_func_t filter_func[] = {
sb_rt_sigaction,
sb_rt_sigprocmask,
@ -453,7 +469,8 @@ static sandbox_filter_func_t filter_func[] = {
sb_mprotect,
sb_flock,
sb_futex,
sb_mremap
sb_mremap,
sb_poll
};
const char*