diff options
| author | Nick Mathewson <nickm@torproject.org> | 2018-02-01 08:39:38 -0500 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2018-02-01 08:39:38 -0500 |
| commit | ea8e9f17f52877cc795f1792acb81d7fdaff6baf (patch) | |
| tree | 4d8edb55e004e36820578fa2507026a18e540b67 /src/common | |
| parent | 88b146cda58087dea5d8945e02f2e2f5ebbe6a97 (diff) | |
| download | tor-ea8e9f17f52877cc795f1792acb81d7fdaff6baf.tar.gz tor-ea8e9f17f52877cc795f1792acb81d7fdaff6baf.zip | |
Revert "Change the sandbox behavior on all failed opens() to EACCES"
This reverts commit 9a06282546418b2e9d21559d4853bcf124b953f4.
It appears that I misunderstood how the seccomp2 filter rules
interact. It appears that `SCMP_ACT_ERRNO()` always takes
precedence over `SCMP_ACT_ALLOW()` -- I had thought instead that
earlier rules would override later ones. But this change caused bug
25115 (not in any released Tor).
Diffstat (limited to 'src/common')
| -rw-r--r-- | src/common/sandbox.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 043b8bf14f..37f582048c 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -481,14 +481,18 @@ sb_open(scmp_filter_ctx ctx, sandbox_cfg_t *filter) } } - rc = seccomp_rule_add_0(ctx, SCMP_ACT_ERRNO(EACCES), SCMP_SYS(open)); + rc = seccomp_rule_add_1(ctx, SCMP_ACT_ERRNO(EACCES), SCMP_SYS(open), + SCMP_CMP_MASKED(1, O_CLOEXEC|O_NONBLOCK|O_NOCTTY|O_NOFOLLOW, + O_RDONLY)); if (rc != 0) { log_err(LD_BUG,"(Sandbox) failed to add open syscall, received libseccomp " "error %d", rc); return rc; } - rc = seccomp_rule_add_0(ctx, SCMP_ACT_ERRNO(EACCES), SCMP_SYS(openat)); + rc = seccomp_rule_add_1(ctx, SCMP_ACT_ERRNO(EACCES), SCMP_SYS(openat), + SCMP_CMP_MASKED(2, O_CLOEXEC|O_NONBLOCK|O_NOCTTY|O_NOFOLLOW, + O_RDONLY)); if (rc != 0) { log_err(LD_BUG,"(Sandbox) failed to add openat syscall, received " "libseccomp error %d", rc); |