Commit 61949707 authored by Nick Mathewson's avatar Nick Mathewson 🐚
Browse files

Don't allow change to ConnLimit while sandbox is active

parent 18f7f49a

src/common/sandbox.c

+11 −0
Original line number Diff line number Diff line
@@ -1576,6 +1576,11 @@ initialise_libseccomp_sandbox(sandbox_cfg_t* cfg) 
  return 0;

}



int

sandbox_is_active(void)

{

  return sandbox_active != 0;

}

#endif // USE_LIBSECCOMP



sandbox_cfg_t*
@@ -1672,5 +1677,11 @@ sandbox_cfg_allow_rename(sandbox_cfg_t **cfg, char *file1, char *file2) 
  (void)cfg; (void)file1; (void)file2;

  return 0;

}



int

sandbox_is_active(void)

{

  return 0;

}

#endif

src/common/sandbox.h

+3 −0
Original line number Diff line number Diff line
@@ -229,5 +229,8 @@ int sandbox_cfg_allow_stat_filename_array(sandbox_cfg_t **cfg, ...); 
/** Function used to initialise a sandbox configuration.*/

int sandbox_init(sandbox_cfg_t* cfg);



/** Return true iff the sandbox is turned on. */

int sandbox_is_active(void);



#endif /* SANDBOX_H_ */

src/or/config.c

+12 −6
Original line number Diff line number Diff line
@@ -1043,12 +1043,18 @@ options_act_reversible(const or_options_t *old_options, char **msg) 
  if (running_tor) {

    int n_ports=0;

    /* We need to set the connection limit before we can open the listeners. */

    if (! sandbox_is_active()) {

      if (set_max_file_descriptors((unsigned)options->ConnLimit,

                                   &options->ConnLimit_) < 0) {

      *msg = tor_strdup("Problem with ConnLimit value. See logs for details.");

        *msg = tor_strdup("Problem with ConnLimit value. "

                          "See logs for details.");

        goto rollback;

      }

      set_conn_limit = 1;

    } else {

      tor_assert(old_options);

      options->ConnLimit_ = old_options->ConnLimit_;

    }



    /* Set up libevent.  (We need to do this before we can register the

     * listeners as listeners.) */