diff options
| author | Nick Mathewson <nickm@torproject.org> | 2016-03-14 14:07:02 -0400 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2016-03-14 14:07:02 -0400 |
| commit | dd7c99961774c19c6042100e660104c687ad6e22 (patch) | |
| tree | aac0e78501da57cff0b7a1e101d1e21a8ed4d890 /src/common/sandbox.h | |
| parent | 0cdeac77e0332c37dd4cc7867e34214961db9009 (diff) | |
| download | tor-dd7c99961774c19c6042100e660104c687ad6e22.tar.gz tor-dd7c99961774c19c6042100e660104c687ad6e22.zip | |
Make unix sockets work with the linux seccomp2 sandbox again
I didn't want to grant blanket permissions for chmod() and chown(),
so here's what I had to do:
* Grant open() on all parent directories of a unix socket
* Write code to allow chmod() and chown() on a given file only.
* Grant chmod() and chown() on the unix socket.
Diffstat (limited to 'src/common/sandbox.h')
| -rw-r--r-- | src/common/sandbox.h | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/common/sandbox.h b/src/common/sandbox.h index b4cc9f7d18..4918ad047b 100644 --- a/src/common/sandbox.h +++ b/src/common/sandbox.h @@ -149,6 +149,9 @@ sandbox_cfg_t * sandbox_cfg_new(void); */ int sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file); +int sandbox_cfg_allow_chmod_filename(sandbox_cfg_t **cfg, char *file); +int sandbox_cfg_allow_chown_filename(sandbox_cfg_t **cfg, char *file); + /**DOCDOC*/ int sandbox_cfg_allow_rename(sandbox_cfg_t **cfg, char *file1, char *file2); |