diff options
| author | Daniel Pinto <danielpinto52@gmail.com> | 2016-07-09 00:36:37 +0100 |
|---|---|---|
| committer | Daniel Pinto <danielpinto52@gmail.com> | 2016-07-09 00:36:37 +0100 |
| commit | 20e89453fde13ef154b69674255b905dc2b85fd7 (patch) | |
| tree | ac1e969b156ecc61602a01ed171bae03cdfc7992 | |
| parent | 7c25b41c8cfffebddbc7ba4d66aa345642eebc1f (diff) | |
| download | tor-20e89453fde13ef154b69674255b905dc2b85fd7.tar.gz tor-20e89453fde13ef154b69674255b905dc2b85fd7.zip | |
Adds missing syscalls to seccomp filter.
Fixes #18397 which prevented tor starting with Sandbox 1.
| -rw-r--r-- | src/common/sandbox.c | 21 |
1 files changed, 20 insertions, 1 deletions
diff --git a/src/common/sandbox.c b/src/common/sandbox.c index bcbb3ce3fa..b194c240d7 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -207,7 +207,10 @@ static int filter_nopar_gen[] = { // getaddrinfo uses this.. SCMP_SYS(stat64), #endif - +#ifdef __NR_sysinfo + // qsort uses this.. + SCMP_SYS(sysinfo), +#endif /* * These socket syscalls are not required on x86_64 and not supported with * some libseccomp versions (eg: 1.0.1) @@ -646,6 +649,14 @@ sb_setsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter) if (rc) return rc; +#ifdef HAVE_SYSTEMD + rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt), + SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET), + SCMP_CMP(2, SCMP_CMP_EQ, SO_SNDBUFFORCE)); + if (rc) + return rc; +#endif + #ifdef IP_TRANSPARENT rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt), SCMP_CMP(1, SCMP_CMP_EQ, SOL_IP), @@ -679,6 +690,14 @@ sb_getsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter) if (rc) return rc; +#ifdef HAVE_SYSTEMD + rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt), + SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET), + SCMP_CMP(2, SCMP_CMP_EQ, SO_SNDBUF)); + if (rc) + return rc; +#endif + #ifdef HAVE_LINUX_NETFILTER_IPV4_H rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt), SCMP_CMP(1, SCMP_CMP_EQ, SOL_IP), |