diff options
| author | Daniel Pinto <danielpinto52@gmail.com> | 2020-05-06 22:00:50 +0100 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2020-05-12 12:56:06 -0400 |
| commit | 2913dbd6d9c1ee53c5a7524dd6693f5a6c6f8293 (patch) | |
| tree | 1cb1dea46247c3ea5ada3bdf27f23aa0f2ef803b /src/lib/sandbox | |
| parent | dd795fbee4c7ec8ec6ecfed46d25551bc1164921 (diff) | |
| download | tor-2913dbd6d9c1ee53c5a7524dd6693f5a6c6f8293.tar.gz tor-2913dbd6d9c1ee53c5a7524dd6693f5a6c6f8293.zip | |
Fix crash when tor is compiled with NSS and seccomp sandbox is enabled
Adds seccomp rules for socket and getpeername used by NSS
Diffstat (limited to 'src/lib/sandbox')
| -rw-r--r-- | src/lib/sandbox/sandbox.c | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/src/lib/sandbox/sandbox.c b/src/lib/sandbox/sandbox.c index 8f577b0660..b701c00160 100644 --- a/src/lib/sandbox/sandbox.c +++ b/src/lib/sandbox/sandbox.c @@ -265,6 +265,11 @@ static int filter_nopar_gen[] = { SCMP_SYS(listen), SCMP_SYS(connect), SCMP_SYS(getsockname), +#ifdef ENABLE_NSS +#ifdef __NR_getpeername + SCMP_SYS(getpeername), +#endif +#endif SCMP_SYS(recvmsg), SCMP_SYS(recvfrom), SCMP_SYS(sendto), @@ -647,6 +652,15 @@ sb_socket(scmp_filter_ctx ctx, sandbox_cfg_t *filter) } } +#ifdef ENABLE_NSS + rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), + SCMP_CMP(0, SCMP_CMP_EQ, PF_INET), + SCMP_CMP(1, SCMP_CMP_EQ, SOCK_STREAM), + SCMP_CMP(2, SCMP_CMP_EQ, IPPROTO_IP)); + if (rc) + return rc; +#endif + rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), SCMP_CMP(0, SCMP_CMP_EQ, PF_UNIX), SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, SOCK_STREAM), |