diff options
author | Nick Mathewson <nickm@torproject.org> | 2018-02-11 18:11:04 -0500 |
---|---|---|
committer | Nick Mathewson <nickm@torproject.org> | 2018-02-11 18:11:04 -0500 |
commit | cb42f93a923ddf7455d7553e63abcf320bd2a00b (patch) | |
tree | c6a2284df5a0f69b8294ee89f96271332959cf43 | |
parent | 27c30bc227b06bb43e170c454f8987f3a45b67cb (diff) | |
parent | 84c13336c410ac218c70d6ce2ce6216f9b24e796 (diff) | |
download | tor-cb42f93a923ddf7455d7553e63abcf320bd2a00b.tar.gz tor-cb42f93a923ddf7455d7553e63abcf320bd2a00b.zip |
Merge branch 'maint-0.2.9' into release-0.2.9
-rw-r--r-- | changes/bug24198 | 4 | ||||
-rw-r--r-- | src/common/sandbox.c | 16 |
2 files changed, 19 insertions, 1 deletions
diff --git a/changes/bug24198 b/changes/bug24198 new file mode 100644 index 0000000000..6790706872 --- /dev/null +++ b/changes/bug24198 @@ -0,0 +1,4 @@ + o Minor bugfixes (controller, linux seccomp2 sandbox): + - Avoid a crash when attempting to use the seccomp2 sandbox + together with the OwningControllerProcess feature. + Fixes bug 24198; bugfix on 0.2.5.1-alpha. diff --git a/src/common/sandbox.c b/src/common/sandbox.c index d0ead2caec..b90ae02578 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -1112,6 +1112,19 @@ sb_stat64(scmp_filter_ctx ctx, sandbox_cfg_t *filter) } #endif +static int +sb_kill(scmp_filter_ctx ctx, sandbox_cfg_t *filter) +{ + (void) filter; +#ifdef __NR_kill + /* Allow killing anything with signal 0 -- it isn't really a kill. */ + return seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(kill), + SCMP_CMP(1, SCMP_CMP_EQ, 0)); +#else + return 0; +#endif +} + /** * Array of function pointers responsible for filtering different syscalls at * a parameter level. @@ -1150,7 +1163,8 @@ static sandbox_filter_func_t filter_func[] = { sb_socket, sb_setsockopt, sb_getsockopt, - sb_socketpair + sb_socketpair, + sb_kill }; const char * |