mirrors/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-19 18:00:33 +01:00
Code Issues Projects Releases Wiki Activity

Correct how we use libseccomp

Browse Source 
This fixes a startup crash with libseccomp v2.4.0 if Sandbox is
set to 1.
This commit is contained in:
Peter Gerber 2019-06-10 14:56:31 +02:00 committed by Nick Mathewson
parent 1cd20ff848
commit 0d64bafcfe
2 changed files with 10 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
changes/bug29819 Normal file
View File

@ -0,0 +1,8 @@
o Minor bugfixes (linux seccomp sandbox):
- Correct how we use libseccomp. Particularly, stop assuming that
rules are applied in a particular order or that more rules are
processed after the first match. Neither is the case! In libseccomp
<2.4.0 this lead to some rules having no effect. Libseccomp 2.4.0
changed how rules are generated leading to a different ordering
which in turn lead to a fatal crash during startup. Fixes bug
29819; bugfix on 0.2.5.1-alpha. Patch by Peter Gerber.

40
src/lib/sandbox/sandbox.c
View File

@ -491,24 +491,6 @@ sb_open(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
} }
} }
rc = seccomp_rule_add_1(ctx, SCMP_ACT_ERRNO(EACCES), SCMP_SYS(open),
SCMP_CMP_MASKED(1, O_CLOEXEC|O_NONBLOCK|O_NOCTTY|O_NOFOLLOW,
O_RDONLY));
if (rc != 0) {
log_err(LD_BUG,"(Sandbox) failed to add open syscall, received libseccomp "
"error %d", rc);
return rc;
}
rc = seccomp_rule_add_1(ctx, SCMP_ACT_ERRNO(EACCES), SCMP_SYS(openat),
SCMP_CMP_MASKED(2, O_CLOEXEC|O_NONBLOCK|O_NOCTTY|O_NOFOLLOW,
O_RDONLY));
if (rc != 0) {
log_err(LD_BUG,"(Sandbox) failed to add openat syscall, received "
"libseccomp error %d", rc);
return rc;
}
return 0; return 0;
} }
@ -562,23 +544,6 @@ sb_chown(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
return 0; return 0;
} }
static int
sb__sysctl(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
{
int rc;
(void) filter;
(void) ctx;
rc = seccomp_rule_add_0(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(_sysctl));
if (rc != 0) {
log_err(LD_BUG,"(Sandbox) failed to add _sysctl syscall, "
"received libseccomp error %d", rc);
return rc;
}
return 0;
}
/** /**
* Function responsible for setting up the rename syscall for * Function responsible for setting up the rename syscall for
* the seccomp filter sandbox. * the seccomp filter sandbox.
@ -1141,7 +1106,6 @@ static sandbox_filter_func_t filter_func[] = {
sb_chmod, sb_chmod,
sb_open, sb_open,
sb_openat, sb_openat,
sb__sysctl,
sb_rename, sb_rename,
#ifdef __NR_fcntl64 #ifdef __NR_fcntl64
sb_fcntl64, sb_fcntl64,
@ -1518,14 +1482,14 @@ install_syscall_filter(sandbox_cfg_t* cfg)
int rc = 0; int rc = 0;
scmp_filter_ctx ctx; scmp_filter_ctx ctx;
ctx = seccomp_init(SCMP_ACT_TRAP); ctx = seccomp_init(SCMP_ACT_ERRNO(EPERM));
if (ctx == NULL) { if (ctx == NULL) {
log_err(LD_BUG,"(Sandbox) failed to initialise libseccomp context"); log_err(LD_BUG,"(Sandbox) failed to initialise libseccomp context");
rc = -1; rc = -1;
goto end; goto end;
} }
// protectign sandbox parameter strings // protecting sandbox parameter strings
if ((rc = prot_strings(ctx, cfg))) { if ((rc = prot_strings(ctx, cfg))) {
goto end; goto end;
} }