Sandbox causes crash when creating a hidden service through the control port
I'm trying to squash a bug with running OnionShare in Tails and I've narrowed it down to a bug in the Tor server in sandbox mode. Here's the related OnionShare issue: https://github.com/micahflee/onionshare/issues/179
Here's a simple script that creates a hidden service using the Tor control port, with stem and flask:
```
import os
from stem.control import Controller
from flask import Flask
def main():
# set up flask
app = Flask("example")
@app.route('/')
def index():
return "<h1>Testing Tor sandbox!</h1>"
# set up hidden service
controller = Controller.from_port()
controller.authenticate()
hs_dir = '/tmp/bugtest'
print "Creating our hidden service in %s" % hs_dir
controller.set_options([
('HiddenServiceDir', hs_dir),
('HiddenServicePort', '80 127.0.0.1:5000')
])
onion = open(hs_dir + "/hostname", "r").read().strip()
print 'Running on {0}'.format(onion)
# start web app
app.run(port=5000)
if __name__ == '__main__':
main()
```
(Note that you need to manually delete /tmp/bugtest before running this script a second time.)
If you set "Sandbox 0" in torrc and run this script, it works great, and the output looks like this:
```
user@dev:~/code/tor-sandbox-hs-bug$ sudo python tor-sandbox-hs-bug.py
Creating our hidden service in /tmp/bugtest
Running on 3ekculjvzye6zr6s.onion
* Running on http://127.0.0.1:5000/
127.0.0.1 - - [18/May/2015 15:37:56] "GET / HTTP/1.1" 200 -
127.0.0.1 - - [18/May/2015 15:37:59] "GET /favicon.ico HTTP/1.1" 404 -
```
But if you set "Sandbox 1" in torrc and run the same script again, the script throws an exception and tor crashes:
```
user@dev:~/code/tor-sandbox-hs-bug$ sudo python tor-sandbox-hs-bug.py
Creating our hidden service in /tmp/bugtest
Traceback (most recent call last):
File "tor-sandbox-hs-bug.py", line 32, in <module>
main()
File "tor-sandbox-hs-bug.py", line 22, in main
('HiddenServicePort', '80 127.0.0.1:5000')
File "/usr/lib/python2.7/dist-packages/stem/control.py", line 1859, in set_options
response = self.msg(query)
File "/usr/lib/python2.7/dist-packages/stem/control.py", line 469, in msg
raise exc
stem.SocketClosed: Received empty socket content.
```
Here's what ends up in the tor log:
```
May 18 15:38:48.000 [notice] New control connection opened from 127.0.0.1.
May 18 15:38:48.000 [notice] Tor 0.2.5.12 (git-3731dd5c3071dcba) opening log file.
May 18 15:38:48.000 [warn] sandbox_intern_string(): Bug: No interned sandbox parameter found for /tmp/bugtest
May 18 15:38:48.000 [warn] sandbox_intern_string(): Bug: No interned sandbox parameter found for /tmp/bugtest/private_key
May 18 15:38:48.000 [warn] sandbox_intern_string(): Bug: No interned sandbox parameter found for /tmp/bugtest/private_key.tmp
============================================================ T= 1431988728
(Sandbox) Caught a bad syscall attempt (syscall open)
/usr/bin/tor(+0x128176)[0x7f1391729176]
/lib/x86_64-linux-gnu/libpthread.so.0(open64+0x10)[0x7f13901fa1d0]
/lib/x86_64-linux-gnu/libpthread.so.0(open64+0x10)[0x7f13901fa1d0]
/usr/bin/tor(tor_open_cloexec+0x40)[0x7f1391715380]
/usr/bin/tor(start_writing_to_file+0xf2)[0x7f1391724182]
/usr/bin/tor(+0x1232eb)[0x7f13917242eb]
/usr/bin/tor(+0x123438)[0x7f1391724438]
/usr/bin/tor(crypto_pk_write_private_key_to_filename+0xcb)[0x7f1391731b6b]
/usr/bin/tor(init_key_from_file+0x172)[0x7f1391668302]
/usr/bin/tor(+0x5a36e)[0x7f139165b36e]
/usr/bin/tor(rend_service_load_all_keys+0x81)[0x7f139165d451]
/usr/bin/tor(set_options+0xc5f)[0x7f13916bff5f]
/usr/bin/tor(options_trial_assign+0xbb)[0x7f13916c14fb]
/usr/bin/tor(+0xdbe2e)[0x7f13916dce2e]
/usr/bin/tor(connection_control_process_inbuf+0x776)[0x7f13916e1056]
/usr/bin/tor(+0xcbd95)[0x7f13916ccd95]
/usr/bin/tor(+0x34a21)[0x7f1391635a21]
/usr/lib/x86_64-linux-gnu/libevent-2.0.so.5(event_base_loop+0x7fc)[0x7f1390c8a3dc]
/usr/bin/tor(do_main_loop+0x194)[0x7f1391637204]
/usr/bin/tor(tor_main+0x1705)[0x7f139163a035]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5)[0x7f138fc5fb45]
/usr/bin/tor(+0x3279b)[0x7f139163379b]
```
issue