September 2013 - tor-commits - lists.torproject.org

[tor/master] added contingency message to test for sandbox_getaddrinfo
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit fe6e2733ab1e75e0b56741fa06094b257b3695b8 Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Mon Sep 2 12:16:02 2013 +0300 added contingency message to test for sandbox_getaddrinfo --- src/common/sandbox.c | 3 ++- src/or/main.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index a491912..84d2183 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -930,6 +930,7 @@ sandbox_getaddrinfo(const char *name, struct addrinfo **res) } } + log_err(LD_BUG,"(Sandbox) failed to get address %s!", name); return -1; } @@ -958,7 +959,7 @@ sandbox_add_addrinfo(const char* name) goto out; } - el->name = strdup(name); + el->name = tor_strdup(name); el->next = sb_addr_info; sb_addr_info = el; diff --git a/src/or/main.c b/src/or/main.c index af05f0b..5ab4936 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -2640,7 +2640,8 @@ find_flashcard_path(PWCHAR path, size_t size) #endif static void -init_addrinfo(void) { +init_addrinfo(void) +{ char hname[256]; // host name to sandbox

1 0

[tor/master] passing hints as a const pointer to sandbox_getaddrinfo(), also one tor_free macro fails to compile..
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit 6a22b29641834cecb446282588f9d47d8678b8b4 Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Fri Sep 6 12:39:56 2013 +0300 passing hints as a const pointer to sandbox_getaddrinfo(), also one tor_free macro fails to compile.. --- src/common/address.c | 2 +- src/common/sandbox.c | 6 +++--- src/common/sandbox.h | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/src/common/address.c b/src/common/address.c index a46aeb0..f9647b9 100644 --- a/src/common/address.c +++ b/src/common/address.c @@ -235,7 +235,7 @@ tor_addr_lookup(const char *name, uint16_t family, tor_addr_t *addr) memset(&hints, 0, sizeof(hints)); hints.ai_family = family; hints.ai_socktype = SOCK_STREAM; - err = sandbox_getaddrinfo(name, hints, &res); + err = sandbox_getaddrinfo(name, &hints, &res); if (!err) { best = NULL; for (res_p = res; res_p; res_p = res_p->ai_next) { diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 7e77ea1..e936b62 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -728,7 +728,7 @@ prot_strings(sandbox_cfg_t* cfg) memcpy(pr_mem_next, param_val, param_size); // re-point el parameter to protected - tor_free((char*) ((smp_param_t*)el->param)->value); + free((char*)((smp_param_t*)el->param)->value); ((smp_param_t*)el->param)->value = (intptr_t) pr_mem_next; ((smp_param_t*)el->param)->prot = 1; @@ -949,7 +949,7 @@ sandbox_cfg_allow_execve_array(sandbox_cfg_t **cfg, ...) } int -sandbox_getaddrinfo(const char *name, struct addrinfo hints, +sandbox_getaddrinfo(const char *name, const struct addrinfo *hints, struct addrinfo **res) { sb_addr_info_t *el; @@ -969,7 +969,7 @@ sandbox_getaddrinfo(const char *name, struct addrinfo hints, } if (!sandbox_active) { - if (getaddrinfo(name, NULL, &hints, res)) { + if (getaddrinfo(name, NULL, hints, res)) { log_err(LD_BUG,"(Sandbox) getaddrinfo failed!"); return -1; } diff --git a/src/common/sandbox.h b/src/common/sandbox.h index 503bb70..ed9caa1 100644 --- a/src/common/sandbox.h +++ b/src/common/sandbox.h @@ -133,7 +133,7 @@ typedef struct { int sandbox_add_addrinfo(const char *addr); /** Replacement for getaddrinfo(), using pre-recorded results. */ -int sandbox_getaddrinfo(const char *name, struct addrinfo hints, +int sandbox_getaddrinfo(const char *name, const struct addrinfo *hints, struct addrinfo **res); /** Use <b>fd</b> to log non-survivable sandbox violations. */

1 0

[tor/master] Remove a usage of free()
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit 42e6ab0e14bc3f6c71e262b4c9d888f67beb599f Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 9 14:58:15 2013 -0400 Remove a usage of free() --- src/common/sandbox.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 2f5859e..6fdddd2 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -830,7 +830,10 @@ prot_strings(sandbox_cfg_t* cfg) memcpy(pr_mem_next, param_val, param_size); // re-point el parameter to protected - free((char*)((smp_param_t*)el->param)->value); + { + void *old_val = ((smp_param_t*)el->param)->value; + tor_free(old_val); + } ((smp_param_t*)el->param)->value = (intptr_t) pr_mem_next; ((smp_param_t*)el->param)->prot = 1;

1 0

[tor/master] Basic compilation fixes.
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit 00fd0cc5f91ad431c4beb25b8cc8f89ff1462268 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 9 14:55:47 2013 -0400 Basic compilation fixes. --- src/common/sandbox.c | 24 ++++++++++++++++++------ src/common/sandbox.h | 6 +++--- src/or/main.c | 6 +++--- 3 files changed, 24 insertions(+), 12 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 1fa4d61..2f5859e 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -118,8 +118,10 @@ static int filter_nopar_gen[] = { SCMP_SYS(exit), SCMP_SYS(madvise), +#ifdef __NR_stat64 // getaddrinfo uses this.. SCMP_SYS(stat64), +#endif // socket syscalls SCMP_SYS(bind), @@ -741,10 +743,14 @@ static sandbox_filter_func_t filter_func[] = { sb_execve, sb_time, sb_accept4, +#ifdef __NR_mmap2 sb_mmap2, +#endif sb_open, sb_openat, +#ifdef __NR_fcntl64 sb_fcntl64, +#endif sb_epoll_ctl, sb_prctl, sb_mprotect, @@ -752,7 +758,9 @@ static sandbox_filter_func_t filter_func[] = { sb_futex, sb_mremap, sb_poll, +#ifdef __NR_stat64 sb_stat64, +#endif sb_socket, sb_setsockopt, @@ -879,12 +887,17 @@ new_element(int syscall, int index, intptr_t value) } #ifdef __NR_stat64 +#define SCMP_stat SCMP_SYS(stat64) +#else +#define SCMP_stat SCMP_SYS(stat) +#endif + int -sandbox_cfg_allow_stat64_filename(sandbox_cfg_t **cfg, char *file, int fr) +sandbox_cfg_allow_stat_filename(sandbox_cfg_t **cfg, char *file, int fr) { sandbox_cfg_t *elem = NULL; - elem = new_element(SCMP_SYS(stat64), 0, (intptr_t) tor_strdup(file)); + elem = new_element(SCMP_stat, 0, (intptr_t) tor_strdup(file)); if (!elem) { log_err(LD_BUG,"(Sandbox) failed to register parameter!"); return -1; @@ -898,7 +911,7 @@ sandbox_cfg_allow_stat64_filename(sandbox_cfg_t **cfg, char *file, int fr) } int -sandbox_cfg_allow_stat64_filename_array(sandbox_cfg_t **cfg, ...) +sandbox_cfg_allow_stat_filename_array(sandbox_cfg_t **cfg, ...) { int rc = 0; char *fn = NULL; @@ -909,9 +922,9 @@ sandbox_cfg_allow_stat64_filename_array(sandbox_cfg_t **cfg, ...) while ((fn = va_arg(ap, char*)) != NULL) { int fr = va_arg(ap, int); - rc = sandbox_cfg_allow_stat64_filename(cfg, fn, fr); + rc = sandbox_cfg_allow_stat_filename(cfg, fn, fr); if (rc) { - log_err(LD_BUG,"(Sandbox) sandbox_cfg_allow_stat64_filename_array fail"); + log_err(LD_BUG,"(Sandbox) sandbox_cfg_allow_stat_filename_array fail"); goto end; } } @@ -920,7 +933,6 @@ sandbox_cfg_allow_stat64_filename_array(sandbox_cfg_t **cfg, ...) va_end(ap); return 0; } -#endif int sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file, int fr) diff --git a/src/common/sandbox.h b/src/common/sandbox.h index ed9caa1..e61e0b3 100644 --- a/src/common/sandbox.h +++ b/src/common/sandbox.h @@ -204,12 +204,12 @@ int sandbox_cfg_allow_execve(sandbox_cfg_t **cfg, char *com); int sandbox_cfg_allow_execve_array(sandbox_cfg_t **cfg, ...); /** - * Function used to add a stat64 allowed filename to a supplied configuration. + * Function used to add a stat/stat64 allowed filename to a configuration. * The (char*) specifies the path to the allowed file, fr = 1 tells the * function that the char* needs to be free-ed, 0 means the pointer does not * need to be free-ed. */ -int sandbox_cfg_allow_stat64_filename(sandbox_cfg_t **cfg, char *file, +int sandbox_cfg_allow_stat_filename(sandbox_cfg_t **cfg, char *file, int fr); /** Function used to add a series of stat64 allowed filenames to a supplied @@ -220,7 +220,7 @@ int sandbox_cfg_allow_stat64_filename(sandbox_cfg_t **cfg, char *file, * that the char* needs to be free-ed, 0 means the pointer does not need to * be free-ed; the final parameter needs to be <NULL, 0>. */ -int sandbox_cfg_allow_stat64_filename_array(sandbox_cfg_t **cfg, ...); +int sandbox_cfg_allow_stat_filename_array(sandbox_cfg_t **cfg, ...); /** Function used to initialise a sandbox configuration.*/ int sandbox_init(sandbox_cfg_t* cfg); diff --git a/src/or/main.c b/src/or/main.c index 5ab4936..18e8bc4 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -2650,7 +2650,7 @@ init_addrinfo(void) } static sandbox_cfg_t* -sandbox_init_filter() +sandbox_init_filter(void) { sandbox_cfg_t *cfg = sandbox_cfg_new(); @@ -2685,7 +2685,7 @@ sandbox_init_filter() NULL, 0 ); - sandbox_cfg_allow_stat64_filename_array(&cfg, + sandbox_cfg_allow_stat_filename_array(&cfg, get_datadir_fname(NULL), 1, get_datadir_fname("lock"), 1, get_datadir_fname("state"), 1, @@ -2714,7 +2714,7 @@ sandbox_init_filter() NULL, 0 ); - sandbox_cfg_allow_stat64_filename_array(&cfg, + sandbox_cfg_allow_stat_filename_array(&cfg, get_datadir_fname("keys"), 1, get_datadir_fname("stats/dirreq-stats"), 1, NULL, 0

1 0

[tor/master] Do not try to add non-existent syscalls.
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit e9ec0cb5506b81f7f7c54e06a95dafac4acb38e3 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 9 15:37:45 2013 -0400 Do not try to add non-existent syscalls. --- src/common/sandbox.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index c6c9348..a5bc892 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -1187,10 +1187,12 @@ add_noparam_filter(scmp_filter_ctx ctx) // add general filters for (i = 0; i < ARRAY_LENGTH(filter_nopar_gen); i++) { + if (filter_nopar_gen[i] < 0) + continue; rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, filter_nopar_gen[i], 0); if (rc != 0) { - log_err(LD_BUG,"(Sandbox) failed to add syscall index %d, " - "received libseccomp error %d", i, rc); + log_err(LD_BUG,"(Sandbox) failed to add syscall index %d (NR=%d), " + "received libseccomp error %d", i, filter_nopar_gen[i], rc); return rc; } }

1 0

[tor/master] Fix most of the --enable-gcc-warnings warnings in the sandbox code
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit cc35d8be8472ae7ae1ebc3421ff798ec1d893c06 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 9 15:14:50 2013 -0400 Fix most of the --enable-gcc-warnings warnings in the sandbox code --- src/common/sandbox.c | 38 ++++++++++++++++++++++++++++---------- src/common/sandbox.h | 2 +- 2 files changed, 29 insertions(+), 11 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 6fdddd2..1fd2119 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -142,12 +142,14 @@ static int filter_nopar_gen[] = { static int sb_rt_sigaction(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { - int i, rc; + unsigned i; + int rc; int param[] = { SIGINT, SIGTERM, SIGPIPE, SIGUSR1, SIGUSR2, SIGHUP, SIGCHLD, #ifdef SIGXFSZ SIGXFSZ #endif }; + (void) filter; for (i = 0; i < ARRAY_LENGTH(param); i++) { rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(rt_sigaction), 1, @@ -195,6 +197,7 @@ sb_execve(scmp_filter_ctx ctx, sandbox_cfg_t *filter) static int sb_time(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { + (void) filter; return seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(time), 1, SCMP_CMP(0, SCMP_CMP_EQ, 0)); } @@ -207,6 +210,7 @@ static int sb_accept4(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; + (void)filter; #ifdef __i386__ rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socketcall), 1, @@ -365,6 +369,7 @@ static int sb_socket(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; + (void) filter; #ifdef __i386__ rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), 0); @@ -411,6 +416,7 @@ static int sb_socketpair(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; + (void) filter; #ifdef __i386__ rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socketpair), 0); @@ -435,6 +441,7 @@ static int sb_setsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; + (void) filter; #ifdef __i386__ rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt), 0); @@ -459,6 +466,7 @@ static int sb_getsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; + (void) filter; #ifdef __i386__ rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt), 0); @@ -521,6 +529,7 @@ static int sb_epoll_ctl(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; + (void) filter; rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(epoll_ctl), 1, SCMP_CMP(1, SCMP_CMP_EQ, EPOLL_CTL_ADD)); @@ -551,6 +560,7 @@ static int sb_prctl(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; + (void) filter; rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(prctl), 1, SCMP_CMP(0, SCMP_CMP_EQ, PR_SET_DUMPABLE)); @@ -571,6 +581,7 @@ static int sb_mprotect(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; + (void) filter; rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mprotect), 1, SCMP_CMP(2, SCMP_CMP_EQ, PROT_READ)); @@ -598,6 +609,7 @@ static int sb_rt_sigprocmask(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; + (void) filter; rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(rt_sigprocmask), 1, SCMP_CMP(0, SCMP_CMP_EQ, SIG_UNBLOCK)); @@ -622,6 +634,7 @@ static int sb_flock(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; + (void) filter; rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(flock), 1, SCMP_CMP(1, SCMP_CMP_EQ, LOCK_EX|LOCK_NB)); @@ -644,6 +657,7 @@ static int sb_futex(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; + (void) filter; // can remove rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(futex), 1, @@ -675,6 +689,7 @@ static int sb_mremap(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; + (void) filter; rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mremap), 1, SCMP_CMP(3, SCMP_CMP_EQ, MREMAP_MAYMOVE)); @@ -692,6 +707,7 @@ static int sb_poll(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; + (void) filter; rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(poll), 2, SCMP_CMP(1, SCMP_CMP_EQ, 1), @@ -825,13 +841,13 @@ prot_strings(sandbox_cfg_t* cfg) char *param_val = (char*)((smp_param_t *)el->param)->value; size_t param_size = strlen(param_val) + 1; - if (pr_mem_left - param_size >= 0) { + if (pr_mem_left >= param_size) { // copy to protected memcpy(pr_mem_next, param_val, param_size); // re-point el parameter to protected { - void *old_val = ((smp_param_t*)el->param)->value; + void *old_val = (void *) ((smp_param_t*)el->param)->value; tor_free(old_val); } ((smp_param_t*)el->param)->value = (intptr_t) pr_mem_next; @@ -900,7 +916,7 @@ sandbox_cfg_allow_stat_filename(sandbox_cfg_t **cfg, char *file, int fr) { sandbox_cfg_t *elem = NULL; - elem = new_element(SCMP_stat, 0, (intptr_t) tor_strdup(file)); + elem = new_element(SCMP_stat, 0, (intptr_t)(void*) tor_strdup(file)); if (!elem) { log_err(LD_BUG,"(Sandbox) failed to register parameter!"); return -1; @@ -942,7 +958,7 @@ sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file, int fr) { sandbox_cfg_t *elem = NULL; - elem = new_element(SCMP_SYS(open), 0, (intptr_t) tor_strdup(file)); + elem = new_element(SCMP_SYS(open), 0, (intptr_t)(void *)tor_strdup(file)); if (!elem) { log_err(LD_BUG,"(Sandbox) failed to register parameter!"); return -1; @@ -985,7 +1001,7 @@ sandbox_cfg_allow_openat_filename(sandbox_cfg_t **cfg, char *file, int fr) { sandbox_cfg_t *elem = NULL; - elem = new_element(SCMP_SYS(openat), 1, (intptr_t) tor_strdup(file)); + elem = new_element(SCMP_SYS(openat), 1, (intptr_t)(void *)tor_strdup(file)); if (!elem) { log_err(LD_BUG,"(Sandbox) failed to register parameter!"); return -1; @@ -1024,11 +1040,11 @@ sandbox_cfg_allow_openat_filename_array(sandbox_cfg_t **cfg, ...) } int -sandbox_cfg_allow_execve(sandbox_cfg_t **cfg, char *com) +sandbox_cfg_allow_execve(sandbox_cfg_t **cfg, const char *com) { sandbox_cfg_t *elem = NULL; - elem = new_element(SCMP_SYS(execve), 1, (intptr_t) tor_strdup(com)); + elem = new_element(SCMP_SYS(execve), 1, (intptr_t)(void *)tor_strdup(com)); if (!elem) { log_err(LD_BUG,"(Sandbox) failed to register parameter!"); return -1; @@ -1141,7 +1157,8 @@ sandbox_add_addrinfo(const char* name) static int add_param_filter(scmp_filter_ctx ctx, sandbox_cfg_t* cfg) { - int i, rc = 0; + unsigned i; + int rc = 0; // function pointer for (i = 0; i < ARRAY_LENGTH(filter_func); i++) { @@ -1162,7 +1179,8 @@ add_param_filter(scmp_filter_ctx ctx, sandbox_cfg_t* cfg) static int add_noparam_filter(scmp_filter_ctx ctx) { - int i, rc = 0; + unsigned i; + int rc = 0; // add general filters for (i = 0; i < ARRAY_LENGTH(filter_nopar_gen); i++) { diff --git a/src/common/sandbox.h b/src/common/sandbox.h index e61e0b3..a1434ce 100644 --- a/src/common/sandbox.h +++ b/src/common/sandbox.h @@ -191,7 +191,7 @@ int sandbox_cfg_allow_openat_filename_array(sandbox_cfg_t **cfg, ...); * function that the char* needs to be free-ed, 0 means the pointer does not * need to be free-ed. */ -int sandbox_cfg_allow_execve(sandbox_cfg_t **cfg, char *com); +int sandbox_cfg_allow_execve(sandbox_cfg_t **cfg, const char *com); /** Function used to add a series of execve allowed filenames to a supplied * configuration.

1 0

[tor/master] Build correctly with older libevents
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit 4e00625bbe030f5c1ae54fb7c4c07dd061ab8644 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 9 15:29:19 2013 -0400 Build correctly with older libevents --- configure.ac | 1 + src/or/main.c | 2 ++ 2 files changed, 3 insertions(+) diff --git a/configure.ac b/configure.ac index e2b2dd6..8992c84 100644 --- a/configure.ac +++ b/configure.ac @@ -400,6 +400,7 @@ AC_CHECK_FUNCS([event_get_version \ event_get_method \ event_set_log_callback \ evdns_set_outgoing_bind_address \ + evutil_secure_rng_set_urandom_device_file \ event_base_loopexit]) AC_CHECK_MEMBERS([struct event.min_heap_idx], , , [#include <event.h> diff --git a/src/or/main.c b/src/or/main.c index 18e8bc4..01f6b5c 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -2804,8 +2804,10 @@ tor_main(int argc, char *argv[]) } // registering libevent rng +#ifdef HAVE_EVUTIL_SECURE_RNG_SET_URANDOM_DEVICE_FILE evutil_secure_rng_set_urandom_device_file( (char*) sandbox_intern_string("/dev/urandom")); +#endif } switch (get_options()->command) {

1 0

[tor/master] Split libevent AC_CHECK_FUNCS call into multiple lines
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit 05f8429a280f80c94fa7c01f6a5c4b654cd02286 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 9 15:18:54 2013 -0400 Split libevent AC_CHECK_FUNCS call into multiple lines --- configure.ac | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac index 68c8ce4..e2b2dd6 100644 --- a/configure.ac +++ b/configure.ac @@ -395,7 +395,12 @@ save_CPPFLAGS="$CPPFLAGS" LIBS="-levent $STATIC_LIBEVENT_FLAGS $TOR_LIB_WS32 $LIBS" LDFLAGS="$TOR_LDFLAGS_libevent $LDFLAGS" CPPFLAGS="$TOR_CPPFLAGS_libevent $CPPFLAGS" -AC_CHECK_FUNCS(event_get_version event_get_version_number event_get_method event_set_log_callback evdns_set_outgoing_bind_address event_base_loopexit) +AC_CHECK_FUNCS([event_get_version \ + event_get_version_number \ + event_get_method \ + event_set_log_callback \ + evdns_set_outgoing_bind_address \ + event_base_loopexit]) AC_CHECK_MEMBERS([struct event.min_heap_idx], , , [#include <event.h> ])

1 0

[tor/master] fixed socket syscall bug
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit 8e003b1c69152ba6e5c3a09db11472eef5db14da Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Tue Sep 10 00:42:36 2013 +0300 fixed socket syscall bug --- src/common/sandbox.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 6db682d..a852cb6 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -1187,8 +1187,6 @@ add_noparam_filter(scmp_filter_ctx ctx) // add general filters for (i = 0; i < ARRAY_LENGTH(filter_nopar_gen); i++) { - if (filter_nopar_gen[i] < 0) - continue; rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, filter_nopar_gen[i], 0); if (rc != 0) { log_err(LD_BUG,"(Sandbox) failed to add syscall index %d (NR=%d), "

1 0

[tor/master] added filter protection for string parameter memory
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit 79f94e236b60dca6feebd2350d2c00f0c9a2eeb7 Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Tue Sep 10 14:35:11 2013 +0300 added filter protection for string parameter memory --- src/common/sandbox.c | 58 +++++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 48 insertions(+), 10 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index a852cb6..6d1e6ef 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -588,11 +588,6 @@ sb_mprotect(scmp_filter_ctx ctx, sandbox_cfg_t *filter) return rc; rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mprotect), 1, - SCMP_CMP(2, SCMP_CMP_EQ, PROT_READ|PROT_WRITE)); - if (rc) - return rc; - - rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mprotect), 1, SCMP_CMP(2, SCMP_CMP_EQ, PROT_NONE)); if (rc) return rc; @@ -810,7 +805,7 @@ sandbox_intern_string(const char *str) * mprotect(). */ static int -prot_strings(sandbox_cfg_t* cfg) +prot_strings(scmp_filter_ctx ctx, sandbox_cfg_t* cfg) { int ret = 0; size_t pr_mem_size = 0, pr_mem_left = 0; @@ -870,6 +865,48 @@ prot_strings(sandbox_cfg_t* cfg) goto out; } + /* + * Setting sandbox restrictions so the string memory cannot be tampered with + */ + // no mremap of the protected base address + ret = seccomp_rule_add(ctx, SCMP_ACT_KILL, SCMP_SYS(mremap), 1, + SCMP_CMP(0, SCMP_CMP_EQ, (intptr_t) pr_mem_base)); + if (ret) { + log_err(LD_BUG,"(Sandbox) mremap protected memory filter fail!"); + return ret; + } + + // no munmap of the protected base address + ret = seccomp_rule_add(ctx, SCMP_ACT_KILL, SCMP_SYS(munmap), 1, + SCMP_CMP(0, SCMP_CMP_EQ, (intptr_t) pr_mem_base)); + if (ret) { + log_err(LD_BUG,"(Sandbox) munmap protected memory filter fail!"); + return ret; + } + + /* + * Allow mprotect with PROT_READ|PROT_WRITE because openssl uses it, but + * never over the memory region used by the protected strings. + * + * PROT_READ|PROT_WRITE was originally fully allowed in sb_mprotect(), but + * had to be removed due to limitation of libseccomp regarding intervals. + */ + ret = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mprotect), 2, + SCMP_CMP(0, SCMP_CMP_LT, (intptr_t) pr_mem_base), + SCMP_CMP(2, SCMP_CMP_EQ, PROT_READ|PROT_WRITE)); + if (ret) { + log_err(LD_BUG,"(Sandbox) mprotect protected memory filter fail (LT)!"); + return ret; + } + + ret = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mprotect), 2, + SCMP_CMP(0, SCMP_CMP_GT, (intptr_t) pr_mem_base + pr_mem_size), + SCMP_CMP(2, SCMP_CMP_EQ, PROT_READ|PROT_WRITE)); + if (ret) { + log_err(LD_BUG,"(Sandbox) mprotect protected memory filter fail (GT)!"); + return ret; + } + out: return ret; } @@ -1216,6 +1253,11 @@ install_syscall_filter(sandbox_cfg_t* cfg) goto end; } + // protectign sandbox parameter strings + if ((rc = prot_strings(ctx, cfg))) { + goto end; + } + // add parameter filters if ((rc = add_param_filter(ctx, cfg))) { log_err(LD_BUG, "(Sandbox) failed to add param filters!"); @@ -1362,10 +1404,6 @@ initialise_libseccomp_sandbox(sandbox_cfg_t* cfg) if (install_sigsys_debugging()) return -1; - if (prot_strings(cfg)) { - return -4; - } - if (install_syscall_filter(cfg)) return -2;

1 0