mirror of
https://gitlab.torproject.org/tpo/core/tor.git
synced 2024-11-13 14:43:46 +01:00
added support for multiple parameters
This commit is contained in:
parent
c15d09293b
commit
e1410f20d7
@ -35,44 +35,44 @@
|
|||||||
|
|
||||||
static ParFilter param_filter[] = {
|
static ParFilter param_filter[] = {
|
||||||
// Example entries
|
// Example entries
|
||||||
{SCMP_SYS(execve), PARAM_PTR, (intptr_t)("/usr/local/bin/tor"), 0},
|
{SCMP_SYS(execve), PARAM_PTR, 0, (intptr_t)("/usr/local/bin/tor"), 0},
|
||||||
{SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGINT), 0},
|
{SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGINT), 0},
|
||||||
{SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGTERM), 0},
|
{SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGTERM), 0},
|
||||||
{SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGPIPE), 0},
|
{SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGPIPE), 0},
|
||||||
{SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGUSR1), 0},
|
{SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGUSR1), 0},
|
||||||
{SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGUSR2), 0},
|
{SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGUSR2), 0},
|
||||||
{SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGHUP), 0},
|
{SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGHUP), 0},
|
||||||
#ifdef SIGXFSZ
|
#ifdef SIGXFSZ
|
||||||
{SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGXFSZ), 0},
|
{SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGXFSZ), 0},
|
||||||
#endif
|
#endif
|
||||||
{SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGCHLD), 0},
|
{SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGCHLD), 0},
|
||||||
{SCMP_SYS(open), PARAM_PTR,
|
{SCMP_SYS(open), PARAM_PTR, 0,
|
||||||
(intptr_t)("/home/cristi/.tor/cached-certs"), 0},
|
(intptr_t)("/home/cristi/.tor/cached-certs"), 0},
|
||||||
{SCMP_SYS(open), PARAM_PTR,
|
{SCMP_SYS(open), PARAM_PTR, 0,
|
||||||
(intptr_t)("/home/cristi/.tor/cached-consensus"), 0},
|
(intptr_t)("/home/cristi/.tor/cached-consensus"), 0},
|
||||||
{SCMP_SYS(open), PARAM_PTR,
|
{SCMP_SYS(open), PARAM_PTR, 0,
|
||||||
(intptr_t)("/home/cristi/.tor/unverified-consensus"), 0},
|
(intptr_t)("/home/cristi/.tor/unverified-consensus"), 0},
|
||||||
{SCMP_SYS(open), PARAM_PTR,
|
{SCMP_SYS(open), PARAM_PTR, 0,
|
||||||
(intptr_t)("/home/cristi/.tor/cached-microdesc-consensus"), 0},
|
(intptr_t)("/home/cristi/.tor/cached-microdesc-consensus"), 0},
|
||||||
{SCMP_SYS(open), PARAM_PTR,
|
{SCMP_SYS(open), PARAM_PTR, 0,
|
||||||
(intptr_t)("/home/cristi/.tor/cached-microdesc-consensus.tmp"), 0},
|
(intptr_t)("/home/cristi/.tor/cached-microdesc-consensus.tmp"), 0},
|
||||||
{SCMP_SYS(open), PARAM_PTR,
|
{SCMP_SYS(open), PARAM_PTR, 0,
|
||||||
(intptr_t)("/home/cristi/.tor/cached-microdescs"), 0},
|
(intptr_t)("/home/cristi/.tor/cached-microdescs"), 0},
|
||||||
{SCMP_SYS(open), PARAM_PTR,
|
{SCMP_SYS(open), PARAM_PTR, 0,
|
||||||
(intptr_t)("/home/cristi/.tor/cached-microdescs.new"), 0},
|
(intptr_t)("/home/cristi/.tor/cached-microdescs.new"), 0},
|
||||||
{SCMP_SYS(open), PARAM_PTR,
|
{SCMP_SYS(open), PARAM_PTR, 0,
|
||||||
(intptr_t)("/home/cristi/.tor/unverified-microdesc-consensus"), 0},
|
(intptr_t)("/home/cristi/.tor/unverified-microdesc-consensus"), 0},
|
||||||
{SCMP_SYS(open), PARAM_PTR,
|
{SCMP_SYS(open), PARAM_PTR, 0,
|
||||||
(intptr_t)("/home/cristi/.tor/cached-descriptors"), 0},
|
(intptr_t)("/home/cristi/.tor/cached-descriptors"), 0},
|
||||||
{SCMP_SYS(open), PARAM_PTR,
|
{SCMP_SYS(open), PARAM_PTR, 0,
|
||||||
(intptr_t)("/home/cristi/.tor/cached-descriptors.new"), 0},
|
(intptr_t)("/home/cristi/.tor/cached-descriptors.new"), 0},
|
||||||
{SCMP_SYS(open), PARAM_PTR,
|
{SCMP_SYS(open), PARAM_PTR, 0,
|
||||||
(intptr_t)("/home/cristi/.tor/cached-extrainfo"), 0},
|
(intptr_t)("/home/cristi/.tor/cached-extrainfo"), 0},
|
||||||
{SCMP_SYS(open), PARAM_PTR,
|
{SCMP_SYS(open), PARAM_PTR, 0,
|
||||||
(intptr_t)("/home/cristi/.tor/state.tmp"), 0},
|
(intptr_t)("/home/cristi/.tor/state.tmp"), 0},
|
||||||
{SCMP_SYS(open), PARAM_PTR,
|
{SCMP_SYS(open), PARAM_PTR, 0,
|
||||||
(intptr_t)("/home/cristi/.tor/unparseable-desc.tmp"), 0},
|
(intptr_t)("/home/cristi/.tor/unparseable-desc.tmp"), 0},
|
||||||
{SCMP_SYS(open), PARAM_PTR,
|
{SCMP_SYS(open), PARAM_PTR, 0,
|
||||||
(intptr_t)("/home/cristi/.tor/unparseable-desc"), 0},
|
(intptr_t)("/home/cristi/.tor/unparseable-desc"), 0},
|
||||||
};
|
};
|
||||||
|
|
||||||
@ -253,7 +253,7 @@ add_param_filter(scmp_filter_ctx ctx)
|
|||||||
param_filter[i].prot = 1;
|
param_filter[i].prot = 1;
|
||||||
|
|
||||||
rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, param_filter[i].syscall, 1,
|
rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, param_filter[i].syscall, 1,
|
||||||
SCMP_A0(SCMP_CMP_EQ, param_filter[i].param));
|
SCMP_CMP(param_filter[i].pindex, SCMP_CMP_EQ, param_filter[i].param));
|
||||||
if (rc != 0) {
|
if (rc != 0) {
|
||||||
log_err(LD_BUG,"(Sandbox) failed to add syscall index %d, "
|
log_err(LD_BUG,"(Sandbox) failed to add syscall index %d, "
|
||||||
"received libseccomp error %d", i, rc);
|
"received libseccomp error %d", i, rc);
|
||||||
|
@ -41,6 +41,7 @@ typedef struct {
|
|||||||
int syscall;
|
int syscall;
|
||||||
|
|
||||||
char ptype;
|
char ptype;
|
||||||
|
char pindex;
|
||||||
intptr_t param;
|
intptr_t param;
|
||||||
|
|
||||||
char prot;
|
char prot;
|
||||||
|
Loading…
Reference in New Issue
Block a user