diff options
| author | Alexander Færøy <ahf@torproject.org> | 2020-06-30 14:19:44 +0000 |
|---|---|---|
| committer | Alexander Færøy <ahf@torproject.org> | 2020-06-30 14:19:44 +0000 |
| commit | ff4bd6699887ea41c1397ec73fb0f9aea519ec76 (patch) | |
| tree | 3ec60210ac826e7250f3f3bf910894540d25256e | |
| parent | 0a3093533357d800389bf2d610bce3d3603ed544 (diff) | |
| parent | 5a38c73f7098e5c7e24198ef71dce140d421efcf (diff) | |
| download | tor-ff4bd6699887ea41c1397ec73fb0f9aea519ec76.tar.gz tor-ff4bd6699887ea41c1397ec73fb0f9aea519ec76.zip | |
Merge branch 'maint-0.4.3' into release-0.4.3
| -rw-r--r-- | changes/bug34130 | 4 | ||||
| -rw-r--r-- | src/lib/sandbox/sandbox.c | 14 |
2 files changed, 18 insertions, 0 deletions
diff --git a/changes/bug34130 b/changes/bug34130 new file mode 100644 index 0000000000..b1e5715fdf --- /dev/null +++ b/changes/bug34130 @@ -0,0 +1,4 @@ + o Minor bugfixes (linux seccomp sandbox nss): + - Fix startup crash when tor is compiled with --enable-nss and + sandbox support is enabled. Fixes bug 34130; bugfix on + 0.3.5.1-alpha. Patch by Daniel Pinto. diff --git a/src/lib/sandbox/sandbox.c b/src/lib/sandbox/sandbox.c index 626a4dc5a5..b917912f4d 100644 --- a/src/lib/sandbox/sandbox.c +++ b/src/lib/sandbox/sandbox.c @@ -266,6 +266,11 @@ static int filter_nopar_gen[] = { SCMP_SYS(listen), SCMP_SYS(connect), SCMP_SYS(getsockname), +#ifdef ENABLE_NSS +#ifdef __NR_getpeername + SCMP_SYS(getpeername), +#endif +#endif SCMP_SYS(recvmsg), SCMP_SYS(recvfrom), SCMP_SYS(sendto), @@ -649,6 +654,15 @@ sb_socket(scmp_filter_ctx ctx, sandbox_cfg_t *filter) } } +#ifdef ENABLE_NSS + rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), + SCMP_CMP(0, SCMP_CMP_EQ, PF_INET), + SCMP_CMP(1, SCMP_CMP_EQ, SOCK_STREAM), + SCMP_CMP(2, SCMP_CMP_EQ, IPPROTO_IP)); + if (rc) + return rc; +#endif + rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), SCMP_CMP(0, SCMP_CMP_EQ, PF_UNIX), SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, SOCK_STREAM), |