mirrors/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2025-02-25 07:07:52 +01:00
Code Issues Projects Releases Wiki Activity

Merge remote-tracking branch 'public/bug16106_02_nm'

Browse source
This commit is contained in:
Nick Mathewson 2018-01-31 15:51:58 -05:00
commit 8b0b850efa
2 changed files with 8 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
changes/bug16106 Normal file
View file

@ -0,0 +1,6 @@
o Minor bugfixes (linux seccomp2 sandbox):
- Cause a wider variety of unpermitted open() calls to fail with the
EACCES error when the sandbox is running. This won't enable any
previously non-working functionality, but it should turn several cases
from crashes into sandbox warnings. Fixes bug 16106; bugfix on
0.2.5.1-alpha.

8
src/common/sandbox.c
View file

@ -481,18 +481,14 @@ sb_open(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
} }
} }
rc = seccomp_rule_add_1(ctx, SCMP_ACT_ERRNO(EACCES), SCMP_SYS(open), rc = seccomp_rule_add_0(ctx, SCMP_ACT_ERRNO(EACCES), SCMP_SYS(open));
SCMP_CMP_MASKED(1, O_CLOEXEC|O_NONBLOCK|O_NOCTTY|O_NOFOLLOW,
O_RDONLY));
if (rc != 0) { if (rc != 0) {
log_err(LD_BUG,"(Sandbox) failed to add open syscall, received libseccomp " log_err(LD_BUG,"(Sandbox) failed to add open syscall, received libseccomp "
"error %d", rc); "error %d", rc);
return rc; return rc;
} }
rc = seccomp_rule_add_1(ctx, SCMP_ACT_ERRNO(EACCES), SCMP_SYS(openat), rc = seccomp_rule_add_0(ctx, SCMP_ACT_ERRNO(EACCES), SCMP_SYS(openat));
SCMP_CMP_MASKED(2, O_CLOEXEC|O_NONBLOCK|O_NOCTTY|O_NOFOLLOW,
O_RDONLY));
if (rc != 0) { if (rc != 0) {
log_err(LD_BUG,"(Sandbox) failed to add openat syscall, received " log_err(LD_BUG,"(Sandbox) failed to add openat syscall, received "
"libseccomp error %d", rc); "libseccomp error %d", rc);