nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-28 14:23:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

added support for multiple parameters

Browse Source
This commit is contained in:
Cristian Toader 2013-07-23 14:22:31 +03:00
parent c15d09293b
commit e1410f20d7
2 changed files with 25 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
src/common/sandbox.c
View File

@ -35,44 +35,44 @@
static ParFilter param_filter[] = { static ParFilter param_filter[] = {
// Example entries // Example entries
{SCMP_SYS(execve), PARAM_PTR, (intptr_t)("/usr/local/bin/tor"), 0}, {SCMP_SYS(execve), PARAM_PTR, 0, (intptr_t)("/usr/local/bin/tor"), 0},
{SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGINT), 0}, {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGINT), 0},
{SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGTERM), 0}, {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGTERM), 0},
{SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGPIPE), 0}, {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGPIPE), 0},
{SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGUSR1), 0}, {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGUSR1), 0},
{SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGUSR2), 0}, {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGUSR2), 0},
{SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGHUP), 0}, {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGHUP), 0},
#ifdef SIGXFSZ #ifdef SIGXFSZ
{SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGXFSZ), 0}, {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGXFSZ), 0},
#endif #endif
{SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGCHLD), 0}, {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGCHLD), 0},
{SCMP_SYS(open), PARAM_PTR, {SCMP_SYS(open), PARAM_PTR, 0,
(intptr_t)("/home/cristi/.tor/cached-certs"), 0}, (intptr_t)("/home/cristi/.tor/cached-certs"), 0},
{SCMP_SYS(open), PARAM_PTR, {SCMP_SYS(open), PARAM_PTR, 0,
(intptr_t)("/home/cristi/.tor/cached-consensus"), 0}, (intptr_t)("/home/cristi/.tor/cached-consensus"), 0},
{SCMP_SYS(open), PARAM_PTR, {SCMP_SYS(open), PARAM_PTR, 0,
(intptr_t)("/home/cristi/.tor/unverified-consensus"), 0}, (intptr_t)("/home/cristi/.tor/unverified-consensus"), 0},
{SCMP_SYS(open), PARAM_PTR, {SCMP_SYS(open), PARAM_PTR, 0,
(intptr_t)("/home/cristi/.tor/cached-microdesc-consensus"), 0}, (intptr_t)("/home/cristi/.tor/cached-microdesc-consensus"), 0},
{SCMP_SYS(open), PARAM_PTR, {SCMP_SYS(open), PARAM_PTR, 0,
(intptr_t)("/home/cristi/.tor/cached-microdesc-consensus.tmp"), 0}, (intptr_t)("/home/cristi/.tor/cached-microdesc-consensus.tmp"), 0},
{SCMP_SYS(open), PARAM_PTR, {SCMP_SYS(open), PARAM_PTR, 0,
(intptr_t)("/home/cristi/.tor/cached-microdescs"), 0}, (intptr_t)("/home/cristi/.tor/cached-microdescs"), 0},
{SCMP_SYS(open), PARAM_PTR, {SCMP_SYS(open), PARAM_PTR, 0,
(intptr_t)("/home/cristi/.tor/cached-microdescs.new"), 0}, (intptr_t)("/home/cristi/.tor/cached-microdescs.new"), 0},
{SCMP_SYS(open), PARAM_PTR, {SCMP_SYS(open), PARAM_PTR, 0,
(intptr_t)("/home/cristi/.tor/unverified-microdesc-consensus"), 0}, (intptr_t)("/home/cristi/.tor/unverified-microdesc-consensus"), 0},
{SCMP_SYS(open), PARAM_PTR, {SCMP_SYS(open), PARAM_PTR, 0,
(intptr_t)("/home/cristi/.tor/cached-descriptors"), 0}, (intptr_t)("/home/cristi/.tor/cached-descriptors"), 0},
{SCMP_SYS(open), PARAM_PTR, {SCMP_SYS(open), PARAM_PTR, 0,
(intptr_t)("/home/cristi/.tor/cached-descriptors.new"), 0}, (intptr_t)("/home/cristi/.tor/cached-descriptors.new"), 0},
{SCMP_SYS(open), PARAM_PTR, {SCMP_SYS(open), PARAM_PTR, 0,
(intptr_t)("/home/cristi/.tor/cached-extrainfo"), 0}, (intptr_t)("/home/cristi/.tor/cached-extrainfo"), 0},
{SCMP_SYS(open), PARAM_PTR, {SCMP_SYS(open), PARAM_PTR, 0,
(intptr_t)("/home/cristi/.tor/state.tmp"), 0}, (intptr_t)("/home/cristi/.tor/state.tmp"), 0},
{SCMP_SYS(open), PARAM_PTR, {SCMP_SYS(open), PARAM_PTR, 0,
(intptr_t)("/home/cristi/.tor/unparseable-desc.tmp"), 0}, (intptr_t)("/home/cristi/.tor/unparseable-desc.tmp"), 0},
{SCMP_SYS(open), PARAM_PTR, {SCMP_SYS(open), PARAM_PTR, 0,
(intptr_t)("/home/cristi/.tor/unparseable-desc"), 0}, (intptr_t)("/home/cristi/.tor/unparseable-desc"), 0},
}; };
@ -253,7 +253,7 @@ add_param_filter(scmp_filter_ctx ctx)
param_filter[i].prot = 1; param_filter[i].prot = 1;
rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, param_filter[i].syscall, 1, rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, param_filter[i].syscall, 1,
SCMP_A0(SCMP_CMP_EQ, param_filter[i].param)); SCMP_CMP(param_filter[i].pindex, SCMP_CMP_EQ, param_filter[i].param));
if (rc != 0) { if (rc != 0) {
log_err(LD_BUG,"(Sandbox) failed to add syscall index %d, " log_err(LD_BUG,"(Sandbox) failed to add syscall index %d, "
"received libseccomp error %d", i, rc); "received libseccomp error %d", i, rc);

1
src/common/sandbox.h
View File

@ -41,6 +41,7 @@ typedef struct {
int syscall; int syscall;
char ptype; char ptype;
char pindex;
intptr_t param; intptr_t param;
char prot; char prot;