diff options
| author | Nick Mathewson <nickm@torproject.org> | 2013-07-12 17:12:43 -0400 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2013-07-12 17:12:43 -0400 |
| commit | aac732322ae132a1659ecbd4039c7d017ddc3d20 (patch) | |
| tree | c3d31d970fb2ce4ffd458e4d415c9f6ce44a29ec /changes | |
| parent | 14d5e7f85e343a48e27c3b8f2b560c4d1aff5315 (diff) | |
| parent | f9c1ba6493478d227c202e4d3444283b2c840a6a (diff) | |
| download | tor-aac732322ae132a1659ecbd4039c7d017ddc3d20.tar.gz tor-aac732322ae132a1659ecbd4039c7d017ddc3d20.zip | |
Merge remote-tracking branch 'public/gsoc-ctoader-cap-phase1-squashed'
Diffstat (limited to 'changes')
| -rw-r--r-- | changes/seccomp2_sandbox | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/changes/seccomp2_sandbox b/changes/seccomp2_sandbox new file mode 100644 index 0000000000..73b3a8d5e4 --- /dev/null +++ b/changes/seccomp2_sandbox @@ -0,0 +1,12 @@ + o Major features (security): + - Use the seccomp2 syscall filtering facility on Linux to limit + which system calls Tor can invoke. This is an experimental, + Linux-only feature to provide defense-in-depth against unknown + attacks. To try turning it on, set "Sandbox 1" in your torrc + file. This is an experimental feature, however, and some things + may break, so please be ready to report bugs. We hope to add + support for better sandboxing in the future, + including more fine-grained filters, better division of + responsibility, and support for more platforms. This work has + been done by Cristian-Matei Toader for Google Summer of Code. + |