diff options
Diffstat (limited to 'src/common')
| -rw-r--r-- | src/common/sandbox.c | 22 | ||||
| -rw-r--r-- | src/common/sandbox.h | 8 |
2 files changed, 24 insertions, 6 deletions
diff --git a/src/common/sandbox.c b/src/common/sandbox.c index f757c8d8e2..7c732157c1 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -28,14 +28,25 @@ #include <sys/mman.h> #include <sys/syscall.h> +#include <bits/signum.h> #include <seccomp.h> #include <signal.h> #include <unistd.h> static ParFilter param_filter[] = { // Example entries - {SCMP_SYS(execve), (intptr_t)("/usr/local/bin/tor"), 0}, - {SCMP_SYS(execve), (intptr_t)("/usr/local/bin/tor"), 0} + {SCMP_SYS(execve), PARAM_PTR, (intptr_t)("/usr/local/bin/tor"), 0}, + {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGINT), 0}, + {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGTERM), 0}, + {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGPIPE), 0}, + {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGUSR1), 0}, + {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGUSR2), 0}, + {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGHUP), 0}, +#ifdef SIGXFSZ + {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGXFSZ), 0}, +#endif + {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGCHLD), 0}, + }; /** Variable used for storing all syscall numbers that will be allowed with the @@ -101,7 +112,6 @@ static int general_filter[] = { SCMP_SYS(prctl), SCMP_SYS(read), SCMP_SYS(rename), - SCMP_SYS(rt_sigaction), SCMP_SYS(rt_sigprocmask), SCMP_SYS(rt_sigreturn), #ifdef __NR_sigreturn @@ -166,7 +176,7 @@ get_prot_param(char *param) for (i = 0; i < filter_size; i++) { if (param_filter[i].prot && !strncmp(param, (char*) param_filter[i].param, - MAX_PARAM_LEN)) { + MAX_PARAM_LEN) && param_filter[i].ptype == PARAM_PTR) { return (char*)(param_filter[i].param); } } @@ -188,7 +198,7 @@ add_param_filter(scmp_filter_ctx ctx) // for each parameter filter for (i = 0; i < filter_size; i++) { - if (!param_filter[i].prot) { + if (!param_filter[i].prot && param_filter[i].ptype == PARAM_PTR) { // allocating protected memory region for parameter param_size = 1 + strnlen((char*) param_filter[i].param, MAX_PARAM_LEN); if (param_size == MAX_PARAM_LEN) { @@ -213,6 +223,8 @@ add_param_filter(scmp_filter_ctx ctx) } } // if not protected + param_filter[i].prot = 1; + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, param_filter[i].syscall, 1, SCMP_A0(SCMP_CMP_EQ, param_filter[i].param)); if (rc != 0) { diff --git a/src/common/sandbox.h b/src/common/sandbox.h index bfb7a730fe..de5699e342 100644 --- a/src/common/sandbox.h +++ b/src/common/sandbox.h @@ -34,9 +34,15 @@ #define MAX_PARAM_LEN 32 +#define PARAM_PTR 0 +#define PARAM_NUM 1 + typedef struct { int syscall; - intptr_t param; // TODO: make this intptr_t to support multiple types + + char ptype; + intptr_t param; + char prot; } ParFilter; |