Commit 99325442 authored by Nick Mathewson's avatar Nick Mathewson 🦀
Browse files

Merge branch 'maint-0.2.8'

parents 3ac43410 c1bfa652

changes/bug18397

0 → 100644
+7 −0
Original line number Diff line number Diff line 
  o Minor bugfixes (Linux seccomp2 sandbox):

    - Add a few missing syscalls to the seccomp2 sandbox: sysinfo,

      getsockopt(SO_SNDBUF), and setsockopt(SO_SNDBUFFORCE). On

      some systems, these are required for Tor to start with

      "Sandbox 1" enabled.

      Fixes bug 18397; bugfix on 0.2.5.1-alpha. Patch from

      Daniel Pinto.

src/common/sandbox.c

+20 −0
Original line number Diff line number Diff line
@@ -210,6 +210,10 @@ static int filter_nopar_gen[] = { 
    SCMP_SYS(getrandom),

#endif



#ifdef __NR_sysinfo

    // qsort uses this..

    SCMP_SYS(sysinfo),

#endif

    /*

     * These socket syscalls are not required on x86_64 and not supported with

     * some libseccomp versions (eg: 1.0.1)
@@ -699,6 +703,14 @@ sb_setsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter) 
  if (rc)

    return rc;



#ifdef HAVE_SYSTEMD

  rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt),

      SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET),

      SCMP_CMP(2, SCMP_CMP_EQ, SO_SNDBUFFORCE));

  if (rc)

    return rc;

#endif



#ifdef IP_TRANSPARENT

  rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt),

      SCMP_CMP(1, SCMP_CMP_EQ, SOL_IP),
@@ -732,6 +744,14 @@ sb_getsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter) 
  if (rc)

    return rc;



#ifdef HAVE_SYSTEMD

  rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt),

      SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET),

      SCMP_CMP(2, SCMP_CMP_EQ, SO_SNDBUF));

  if (rc)

    return rc;

#endif



#ifdef HAVE_LINUX_NETFILTER_IPV4_H

  rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt),

      SCMP_CMP(1, SCMP_CMP_EQ, SOL_IP),