September 2013 - tor-commits - lists.torproject.org

[tor/master] Repair of some of the lost parameter filters history
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit 673349c42ec5e07c0fdb54d2a45f7b104865325b Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Thu Jul 18 18:03:10 2013 +0300 Repair of some of the lost parameter filters history --- src/common/sandbox.c | 104 +++++++++++++++++++++++++++++++++++++++++++------- src/common/sandbox.h | 8 ++++ 2 files changed, 99 insertions(+), 13 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 68be89e..56feae0 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -25,11 +25,18 @@ #if defined(USE_LIBSECCOMP) +#include <sys/mman.h> #include <sys/syscall.h> #include <seccomp.h> #include <signal.h> #include <unistd.h> +static ParFilter param_filter[] = { + // Example entries + {SCMP_SYS(execve), "/usr/local/bin/tor", 0}, + {SCMP_SYS(execve), "/usr/local/bin/tor", 0} +}; + /** Variable used for storing all syscall numbers that will be allowed with the * stage 1 general Tor sandbox. */ @@ -142,6 +149,81 @@ static int general_filter[] = { SCMP_SYS(unlink) }; +static int +add_param_filter(scmp_filter_ctx ctx) +{ + int i, filter_size, param_size, rc = 0; + void *map = NULL; + + if (param_filter != NULL) { + filter_size = sizeof(param_filter) / sizeof(param_filter[0]); + } else { + filter_size = 0; + } + + // for each parameter filter + for (i = 0; i < filter_size; i++) { + if (!param_filter[i].prot) { + // allocating protected memory region for parameter + param_size = 1 + strnlen(param_filter[i].param, MAX_PARAM_LEN); + if (param_size == MAX_PARAM_LEN) { + log_warn(LD_BUG, "(Sandbox) Parameter %i length too large!", i); + } + + map = mmap(NULL, param_size, PROT_READ | PROT_WRITE, MAP_PRIVATE | + MAP_ANON, -1, 0); + if (!map) { + log_err(LD_BUG,"(Sandbox) failed allocate protected memory!"); + return -1; + } + + // copying from non protected to protected + pointer reassign + memcpy(map, param_filter[i].param, param_size); + param_filter[i].param = map; + + // protecting from writes + if (mprotect(param_filter[i].param, param_size, PROT_READ)) { + log_err(LD_BUG,"(Sandbox) failed to protect memory!"); + return -1; + } + } // if not protected + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, param_filter[i].syscall, 1, + param_filter[i].param); + if (rc != 0) { + log_err(LD_BUG,"(Sandbox) failed to add syscall index %d, " + "received libseccomp error %d", i, rc); + return rc; + } + } + + return 0; +} + +static int +add_noparam_filter(scmp_filter_ctx ctx) +{ + int i, filter_size, rc = 0; + + if (general_filter != NULL) { + filter_size = sizeof(general_filter) / sizeof(general_filter[0]); + } else { + filter_size = 0; + } + + // add general filters + for (i = 0; i < filter_size; i++) { + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, general_filter[i], 0); + if (rc != 0) { + log_err(LD_BUG,"(Sandbox) failed to add syscall index %d, " + "received libseccomp error %d", i, rc); + return rc; + } + } + + return 0; +} + /** * Function responsible for setting up and enabling a global syscall filter. * The function is a prototype developed for stage 1 of sandboxing Tor. @@ -150,7 +232,7 @@ static int general_filter[] = { static int install_glob_syscall_filter(void) { - int rc = 0, i, filter_size; + int rc = 0; scmp_filter_ctx ctx; ctx = seccomp_init(SCMP_ACT_TRAP); @@ -160,20 +242,16 @@ install_glob_syscall_filter(void) goto end; } - if (general_filter != NULL) { - filter_size = sizeof(general_filter) / sizeof(general_filter[0]); - } else { - filter_size = 0; + // add parameter filters + if ((rc = add_param_filter(ctx))) { + log_err(LD_BUG, "(Sandbox) failed to add param filters!"); + goto end; } - // add general filters - for (i = 0; i < filter_size; i++) { - rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, general_filter[i], 0); - if (rc != 0) { - log_err(LD_BUG,"(Sandbox) failed to add syscall index %d, " - "received libseccomp error %d", i, rc); - goto end; - } + // adding filters with no parameters + if ((rc = add_noparam_filter(ctx))) { + log_err(LD_BUG, "(Sandbox) failed to add param filters!"); + goto end; } rc = seccomp_load(ctx); diff --git a/src/common/sandbox.h b/src/common/sandbox.h index bd6f0cf..cfbeceb 100644 --- a/src/common/sandbox.h +++ b/src/common/sandbox.h @@ -30,6 +30,14 @@ #define __USE_GNU #include <sys/ucontext.h> +#define MAX_PARAM_LEN 32 + +typedef struct { + int syscall; + char *param; + char prot; +} ParFilter; + /** * Linux 32 bit definitions */

1 0

[tor/master] Added getter for protected parameter
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit e7e2efb717ecefbf7b6eb92760ff272cca0b6eee Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Thu Jul 18 18:11:47 2013 +0300 Added getter for protected parameter --- src/common/sandbox.c | 27 ++++++++++++++++++++++++++- src/common/sandbox.h | 1 + 2 files changed, 27 insertions(+), 1 deletion(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 56feae0..f041012 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -16,6 +16,7 @@ #include "sandbox.h" #include "torlog.h" #include "orconfig.h" +#include "torint.h" #if defined(HAVE_SECCOMP_H) && defined(__linux__) #define USE_LIBSECCOMP @@ -149,6 +150,30 @@ static int general_filter[] = { SCMP_SYS(unlink) }; +char* +get_prot_param(char *param) +{ + int i, filter_size; + + if (param == NULL) + return NULL; + + if (param_filter == NULL) { + filter_size = 0; + } else { + filter_size = sizeof(param_filter) / sizeof(param_filter[0]); + } + + for (i = 0; i < filter_size; i++) { + if (param_filter[i].prot && !strncmp(param, param_filter[i].param, + MAX_PARAM_LEN)) { + return param_filter[i].param; + } + } + + return NULL; +} + static int add_param_filter(scmp_filter_ctx ctx) { @@ -189,7 +214,7 @@ add_param_filter(scmp_filter_ctx ctx) } // if not protected rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, param_filter[i].syscall, 1, - param_filter[i].param); + SCMP_A0(SCMP_CMP_EQ, (intptr_t) param_filter[i].param)); if (rc != 0) { log_err(LD_BUG,"(Sandbox) failed to add syscall index %d, " "received libseccomp error %d", i, rc); diff --git a/src/common/sandbox.h b/src/common/sandbox.h index cfbeceb..4752f1a 100644 --- a/src/common/sandbox.h +++ b/src/common/sandbox.h @@ -58,6 +58,7 @@ typedef struct { void sandbox_set_debugging_fd(int fd); int tor_global_sandbox(void); +char* get_prot_param(char *param); #endif /* SANDBOX_H_ */

1 0

[tor/master] (undo) git test..
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit 8dfa5772e7853f6a0ede99fd0b9284b668ff5cbc Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Thu Jul 18 18:28:55 2013 +0300 (undo) git test.. --- src/common/sandbox.c | 1 - 1 file changed, 1 deletion(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index c71d5d1..f041012 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -32,7 +32,6 @@ #include <signal.h> #include <unistd.h> -// GIT TEST static ParFilter param_filter[] = { // Example entries {SCMP_SYS(execve), "/usr/local/bin/tor", 0},

1 0

[tor/master] git test..
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit b0725c964bac405359148f69bab81a6cfd330c28 Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Thu Jul 18 18:28:10 2013 +0300 git test.. --- src/common/sandbox.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index f041012..c71d5d1 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -32,6 +32,7 @@ #include <signal.h> #include <unistd.h> +// GIT TEST static ParFilter param_filter[] = { // Example entries {SCMP_SYS(execve), "/usr/local/bin/tor", 0},

1 0

[tor/master] changed paramfilter type to intptr_t
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit 7cf1dbfd51f17773e93b509d954371886243a0eb Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Tue Jul 23 10:14:25 2013 +0300 changed paramfilter type to intptr_t --- src/common/sandbox.c | 18 +++++++++--------- src/common/sandbox.h | 4 +++- 2 files changed, 12 insertions(+), 10 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index f041012..f757c8d 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -34,8 +34,8 @@ static ParFilter param_filter[] = { // Example entries - {SCMP_SYS(execve), "/usr/local/bin/tor", 0}, - {SCMP_SYS(execve), "/usr/local/bin/tor", 0} + {SCMP_SYS(execve), (intptr_t)("/usr/local/bin/tor"), 0}, + {SCMP_SYS(execve), (intptr_t)("/usr/local/bin/tor"), 0} }; /** Variable used for storing all syscall numbers that will be allowed with the @@ -165,9 +165,9 @@ get_prot_param(char *param) } for (i = 0; i < filter_size; i++) { - if (param_filter[i].prot && !strncmp(param, param_filter[i].param, + if (param_filter[i].prot && !strncmp(param, (char*) param_filter[i].param, MAX_PARAM_LEN)) { - return param_filter[i].param; + return (char*)(param_filter[i].param); } } @@ -190,7 +190,7 @@ add_param_filter(scmp_filter_ctx ctx) for (i = 0; i < filter_size; i++) { if (!param_filter[i].prot) { // allocating protected memory region for parameter - param_size = 1 + strnlen(param_filter[i].param, MAX_PARAM_LEN); + param_size = 1 + strnlen((char*) param_filter[i].param, MAX_PARAM_LEN); if (param_size == MAX_PARAM_LEN) { log_warn(LD_BUG, "(Sandbox) Parameter %i length too large!", i); } @@ -203,18 +203,18 @@ add_param_filter(scmp_filter_ctx ctx) } // copying from non protected to protected + pointer reassign - memcpy(map, param_filter[i].param, param_size); - param_filter[i].param = map; + memcpy(map, (char*) param_filter[i].param, param_size); + param_filter[i].param = (intptr_t) map; // protecting from writes - if (mprotect(param_filter[i].param, param_size, PROT_READ)) { + if (mprotect((char*) param_filter[i].param, param_size, PROT_READ)) { log_err(LD_BUG,"(Sandbox) failed to protect memory!"); return -1; } } // if not protected rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, param_filter[i].syscall, 1, - SCMP_A0(SCMP_CMP_EQ, (intptr_t) param_filter[i].param)); + SCMP_A0(SCMP_CMP_EQ, param_filter[i].param)); if (rc != 0) { log_err(LD_BUG,"(Sandbox) failed to add syscall index %d, " "received libseccomp error %d", i, rc); diff --git a/src/common/sandbox.h b/src/common/sandbox.h index 4752f1a..bfb7a73 100644 --- a/src/common/sandbox.h +++ b/src/common/sandbox.h @@ -22,6 +22,8 @@ #endif +#include "torint.h" + /** * Linux definitions */ @@ -34,7 +36,7 @@ typedef struct { int syscall; - char *param; + intptr_t param; // TODO: make this intptr_t to support multiple types char prot; } ParFilter;

1 0

[tor/master] added experimental support for open syscall path param
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit c15d09293bdfc90e94ef34369205cc6db9882607 Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Tue Jul 23 14:01:53 2013 +0300 added experimental support for open syscall path param --- src/common/compat.c | 1 + src/common/sandbox.c | 39 +++++++++++++++++++++++++++++++++------ src/common/sandbox.h | 2 +- src/or/routerlist.c | 2 +- 4 files changed, 36 insertions(+), 8 deletions(-) diff --git a/src/common/compat.c b/src/common/compat.c index 69eb064..5b15367 100644 --- a/src/common/compat.c +++ b/src/common/compat.c @@ -125,6 +125,7 @@ tor_open_cloexec(const char *path, int flags, unsigned mode) { int fd; #ifdef O_CLOEXEC + path = get_prot_param(path); fd = open(path, flags|O_CLOEXEC, mode); if (fd >= 0) return fd; diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 7c73215..143995d 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -46,7 +46,34 @@ static ParFilter param_filter[] = { {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGXFSZ), 0}, #endif {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGCHLD), 0}, - + {SCMP_SYS(open), PARAM_PTR, + (intptr_t)("/home/cristi/.tor/cached-certs"), 0}, + {SCMP_SYS(open), PARAM_PTR, + (intptr_t)("/home/cristi/.tor/cached-consensus"), 0}, + {SCMP_SYS(open), PARAM_PTR, + (intptr_t)("/home/cristi/.tor/unverified-consensus"), 0}, + {SCMP_SYS(open), PARAM_PTR, + (intptr_t)("/home/cristi/.tor/cached-microdesc-consensus"), 0}, + {SCMP_SYS(open), PARAM_PTR, + (intptr_t)("/home/cristi/.tor/cached-microdesc-consensus.tmp"), 0}, + {SCMP_SYS(open), PARAM_PTR, + (intptr_t)("/home/cristi/.tor/cached-microdescs"), 0}, + {SCMP_SYS(open), PARAM_PTR, + (intptr_t)("/home/cristi/.tor/cached-microdescs.new"), 0}, + {SCMP_SYS(open), PARAM_PTR, + (intptr_t)("/home/cristi/.tor/unverified-microdesc-consensus"), 0}, + {SCMP_SYS(open), PARAM_PTR, + (intptr_t)("/home/cristi/.tor/cached-descriptors"), 0}, + {SCMP_SYS(open), PARAM_PTR, + (intptr_t)("/home/cristi/.tor/cached-descriptors.new"), 0}, + {SCMP_SYS(open), PARAM_PTR, + (intptr_t)("/home/cristi/.tor/cached-extrainfo"), 0}, + {SCMP_SYS(open), PARAM_PTR, + (intptr_t)("/home/cristi/.tor/state.tmp"), 0}, + {SCMP_SYS(open), PARAM_PTR, + (intptr_t)("/home/cristi/.tor/unparseable-desc.tmp"), 0}, + {SCMP_SYS(open), PARAM_PTR, + (intptr_t)("/home/cristi/.tor/unparseable-desc"), 0}, }; /** Variable used for storing all syscall numbers that will be allowed with the @@ -106,7 +133,6 @@ static int general_filter[] = { SCMP_SYS(mprotect), SCMP_SYS(mremap), SCMP_SYS(munmap), - SCMP_SYS(open), SCMP_SYS(openat), SCMP_SYS(poll), SCMP_SYS(prctl), @@ -175,13 +201,14 @@ get_prot_param(char *param) } for (i = 0; i < filter_size; i++) { - if (param_filter[i].prot && !strncmp(param, (char*) param_filter[i].param, - MAX_PARAM_LEN) && param_filter[i].ptype == PARAM_PTR) { + if (param_filter[i].prot && param_filter[i].ptype == PARAM_PTR + && !strncmp(param, (char*)(param_filter[i].param), MAX_PARAM_LEN)) { return (char*)(param_filter[i].param); } } - return NULL; + log_warn(LD_BUG, "(Sandbox) Parameter %s not found", param); + return param; } static int @@ -213,7 +240,7 @@ add_param_filter(scmp_filter_ctx ctx) } // copying from non protected to protected + pointer reassign - memcpy(map, (char*) param_filter[i].param, param_size); + memcpy(map, (char*) (param_filter[i].param), param_size); param_filter[i].param = (intptr_t) map; // protecting from writes diff --git a/src/common/sandbox.h b/src/common/sandbox.h index de5699e..b973d97 100644 --- a/src/common/sandbox.h +++ b/src/common/sandbox.h @@ -32,7 +32,7 @@ #define __USE_GNU #include <sys/ucontext.h> -#define MAX_PARAM_LEN 32 +#define MAX_PARAM_LEN 64 #define PARAM_PTR 0 #define PARAM_NUM 1 diff --git a/src/or/routerlist.c b/src/or/routerlist.c index a145ba7..465aaed 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -37,7 +37,7 @@ #include "routerlist.h" #include "routerparse.h" #include "routerset.h" - +#include "../common/sandbox.h" // #define DEBUG_ROUTERLIST /****************************************************************************/

1 0

[tor/master] dynamic parameter filter (prototype, not tested)
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit 962d814e52beb8d3ca8c73f3ab48d8566778dcc5 Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Wed Jul 24 17:06:06 2013 +0300 dynamic parameter filter (prototype, not tested) --- src/common/sandbox.c | 144 +++++++++++++++++++++++++++++++++++--------------- src/common/sandbox.h | 15 +++++- 2 files changed, 114 insertions(+), 45 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 377ac06..2657cba 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -33,7 +33,9 @@ #include <signal.h> #include <unistd.h> -static ParFilter param_filter[] = { +ParFilterDynamic *filter_dynamic = NULL; + +static ParFilterStatic filter_static[] = { // Example entries {SCMP_SYS(execve), PARAM_PTR, 0, (intptr_t)("/usr/local/bin/tor"), 0}, {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGINT), 0}, @@ -79,7 +81,7 @@ static ParFilter param_filter[] = { /** Variable used for storing all syscall numbers that will be allowed with the * stage 1 general Tor sandbox. */ -static int general_filter[] = { +static int filter_nopar_gen[] = { SCMP_SYS(access), SCMP_SYS(brk), SCMP_SYS(clock_gettime), @@ -194,16 +196,16 @@ get_prot_param(char *param) if (param == NULL) return NULL; - if (param_filter == NULL) { + if (filter_static == NULL) { filter_size = 0; } else { - filter_size = sizeof(param_filter) / sizeof(param_filter[0]); + filter_size = sizeof(filter_static) / sizeof(filter_static[0]); } for (i = 0; i < filter_size; i++) { - if (param_filter[i].prot && param_filter[i].ptype == PARAM_PTR - && !strncmp(param, (char*)(param_filter[i].param), MAX_PARAM_LEN)) { - return (char*)(param_filter[i].param); + if (filter_static[i].prot && filter_static[i].ptype == PARAM_PTR + && !strncmp(param, (char*)(filter_static[i].param), MAX_PARAM_LEN)) { + return (char*)(filter_static[i].param); } } @@ -211,49 +213,103 @@ get_prot_param(char *param) return param; } +static char* +prot_strdup(char* str) +{ + int param_size = 0; + char *res = NULL; + + if (str == NULL) + goto out; + + // allocating protected memory region for parameter + param_size = 1 + strnlen(str, MAX_PARAM_LEN); + if (param_size == MAX_PARAM_LEN) { + log_warn(LD_BUG, "(Sandbox) Parameter length too large!"); + } + + res = (char*) mmap(NULL, param_size, PROT_READ | PROT_WRITE, MAP_PRIVATE | + MAP_ANON, -1, 0); + if (!res) { + log_err(LD_BUG,"(Sandbox) failed allocate protected memory!"); + goto out; + } + + // copying from non protected to protected + pointer reassign + memcpy(res, str, param_size); + + // protecting from writes + if (mprotect(res, param_size, PROT_READ)) { + log_err(LD_BUG,"(Sandbox) failed to protect memory!"); + return NULL; + } + + out: + return res; +} + +int +add_dynamic_param_filter(char *syscall, char ptype, char pindex, intptr_t val) +{ + ParFilterDynamic **elem; + + for (elem = &filter_dynamic; *elem != NULL; elem = &(*elem)->next); + + *elem = (ParFilterDynamic*) malloc(sizeof(ParFilterDynamic)); + (*elem)->next = NULL; + (*elem)->pindex = pindex; + (*elem)->ptype = ptype; + + switch (ptype) { + case PARAM_PTR: + (*elem)->param = (intptr_t) prot_strdup((char*) val); + (*elem)->prot = 1; + break; + + case PARAM_NUM: + (*elem)->param = val; + (*elem)->prot = 0; + break; + } + + return 0; +} + static int add_param_filter(scmp_filter_ctx ctx) { - int i, filter_size, param_size, rc = 0; - void *map = NULL; + int i, filter_size, rc = 0; + ParFilterDynamic *elem; - if (param_filter != NULL) { - filter_size = sizeof(param_filter) / sizeof(param_filter[0]); + if (filter_static != NULL) { + filter_size = sizeof(filter_static) / sizeof(filter_static[0]); } else { filter_size = 0; } - // for each parameter filter + // for each dynamic parameter filters + for (elem = filter_dynamic; elem != NULL; elem = elem->next) { + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, elem->syscall, 1, + SCMP_CMP(elem->pindex, SCMP_CMP_EQ, elem->param)); + if (rc != 0) { + log_err(LD_BUG,"(Sandbox) failed to add syscall, received libseccomp " + "error %d", rc); + return rc; + } + } + + // for each static parameter filter for (i = 0; i < filter_size; i++) { - if (!param_filter[i].prot && param_filter[i].ptype == PARAM_PTR) { - // allocating protected memory region for parameter - param_size = 1 + strnlen((char*) param_filter[i].param, MAX_PARAM_LEN); - if (param_size == MAX_PARAM_LEN) { - log_warn(LD_BUG, "(Sandbox) Parameter %i length too large!", i); - } - - map = mmap(NULL, param_size, PROT_READ | PROT_WRITE, MAP_PRIVATE | - MAP_ANON, -1, 0); - if (!map) { - log_err(LD_BUG,"(Sandbox) failed allocate protected memory!"); - return -1; - } - - // copying from non protected to protected + pointer reassign - memcpy(map, (char*) (param_filter[i].param), param_size); - param_filter[i].param = (intptr_t) map; - - // protecting from writes - if (mprotect((char*) param_filter[i].param, param_size, PROT_READ)) { - log_err(LD_BUG,"(Sandbox) failed to protect memory!"); - return -1; - } - } // if not protected - - param_filter[i].prot = 1; - - rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, param_filter[i].syscall, 1, - SCMP_CMP(param_filter[i].pindex, SCMP_CMP_EQ, param_filter[i].param)); + if (!filter_static[i].prot && filter_static[i].ptype == PARAM_PTR) { + filter_static[i].param = (intptr_t) prot_strdup( + (char*) (filter_static[i].param)); + } + + filter_static[i].prot = 1; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, filter_static[i].syscall, 1, + SCMP_CMP(filter_static[i].pindex, SCMP_CMP_EQ, + filter_static[i].param)); if (rc != 0) { log_err(LD_BUG,"(Sandbox) failed to add syscall index %d, " "received libseccomp error %d", i, rc); @@ -269,15 +325,15 @@ add_noparam_filter(scmp_filter_ctx ctx) { int i, filter_size, rc = 0; - if (general_filter != NULL) { - filter_size = sizeof(general_filter) / sizeof(general_filter[0]); + if (filter_nopar_gen != NULL) { + filter_size = sizeof(filter_nopar_gen) / sizeof(filter_nopar_gen[0]); } else { filter_size = 0; } // add general filters for (i = 0; i < filter_size; i++) { - rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, general_filter[i], 0); + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, filter_nopar_gen[i], 0); if (rc != 0) { log_err(LD_BUG,"(Sandbox) failed to add syscall index %d, " "received libseccomp error %d", i, rc); diff --git a/src/common/sandbox.h b/src/common/sandbox.h index b80c198..b75161d 100644 --- a/src/common/sandbox.h +++ b/src/common/sandbox.h @@ -45,7 +45,20 @@ typedef struct { intptr_t param; char prot; -} ParFilter; +} ParFilterStatic; + +struct pfd_elem { + int syscall; + + char ptype; + char pindex; + intptr_t param; + + char prot; + + struct pfd_elem *next; +}; +typedef struct pfd_elem ParFilterDynamic; /** * Linux 32 bit definitions

1 0

[tor/master] initia stages of runtime dynamic filters
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit 3dfe1c06396665d4008ba2ea54a0ad23d445df2b Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Thu Jul 25 13:25:20 2013 +0300 initia stages of runtime dynamic filters --- src/common/sandbox.c | 78 +++++++++++++------------------------------------- src/common/sandbox.h | 7 ++--- src/or/main.c | 40 ++++++++++++++++++++++++++ 3 files changed, 63 insertions(+), 62 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 1a842f9..a4afc36 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -33,9 +33,9 @@ #include <signal.h> #include <unistd.h> -ParFilterDynamic *filter_dynamic = NULL; +sandbox_cfg_t *filter_dynamic = NULL; -static ParFilterStatic filter_static[] = { +static sandbox_static_cfg_t filter_static[] = { // Example entries {SCMP_SYS(execve), PARAM_PTR, 0, (intptr_t)("/usr/local/bin/tor"), 0}, {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGINT), 0}, @@ -48,34 +48,6 @@ static ParFilterStatic filter_static[] = { {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGXFSZ), 0}, #endif {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGCHLD), 0}, - {SCMP_SYS(open), PARAM_PTR, 0, - (intptr_t)("/home/cristi/.tor/cached-certs"), 0}, - {SCMP_SYS(open), PARAM_PTR, 0, - (intptr_t)("/home/cristi/.tor/cached-consensus"), 0}, - {SCMP_SYS(open), PARAM_PTR, 0, - (intptr_t)("/home/cristi/.tor/unverified-consensus"), 0}, - {SCMP_SYS(open), PARAM_PTR, 0, - (intptr_t)("/home/cristi/.tor/cached-microdesc-consensus"), 0}, - {SCMP_SYS(open), PARAM_PTR, 0, - (intptr_t)("/home/cristi/.tor/cached-microdesc-consensus.tmp"), 0}, - {SCMP_SYS(open), PARAM_PTR, 0, - (intptr_t)("/home/cristi/.tor/cached-microdescs"), 0}, - {SCMP_SYS(open), PARAM_PTR, 0, - (intptr_t)("/home/cristi/.tor/cached-microdescs.new"), 0}, - {SCMP_SYS(open), PARAM_PTR, 0, - (intptr_t)("/home/cristi/.tor/unverified-microdesc-consensus"), 0}, - {SCMP_SYS(open), PARAM_PTR, 0, - (intptr_t)("/home/cristi/.tor/cached-descriptors"), 0}, - {SCMP_SYS(open), PARAM_PTR, 0, - (intptr_t)("/home/cristi/.tor/cached-descriptors.new"), 0}, - {SCMP_SYS(open), PARAM_PTR, 0, - (intptr_t)("/home/cristi/.tor/cached-extrainfo"), 0}, - {SCMP_SYS(open), PARAM_PTR, 0, - (intptr_t)("/home/cristi/.tor/state.tmp"), 0}, - {SCMP_SYS(open), PARAM_PTR, 0, - (intptr_t)("/home/cristi/.tor/unparseable-desc.tmp"), 0}, - {SCMP_SYS(open), PARAM_PTR, 0, - (intptr_t)("/home/cristi/.tor/unparseable-desc"), 0}, }; /** Variable used for storing all syscall numbers that will be allowed with the @@ -192,7 +164,7 @@ char* get_prot_param(char *param) { int i, filter_size; - ParFilterDynamic *elem; + sandbox_cfg_t *elem; if (param == NULL) return NULL; @@ -256,36 +228,26 @@ prot_strdup(char* str) return res; } -int -add_dynamic_param_filter(char *syscall, char ptype, char pindex, intptr_t val) +sandbox_cfg_t* +sandbox_cfg_new() { - ParFilterDynamic **elem; - - for (elem = &filter_dynamic; *elem != NULL; elem = &(*elem)->next); - - *elem = (ParFilterDynamic*) malloc(sizeof(ParFilterDynamic)); - (*elem)->next = NULL; - (*elem)->pindex = pindex; - (*elem)->ptype = ptype; + return NULL; +} - switch (ptype) { - case PARAM_PTR: - (*elem)->param = (intptr_t) prot_strdup((char*) val); - (*elem)->prot = 1; - break; +int +sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file) +{ + sandbox_cfg_t *elem = (sandbox_cfg_t*) malloc(sizeof(sandbox_cfg_t)); - case PARAM_NUM: - (*elem)->param = val; - (*elem)->prot = 0; - break; - } + elem->syscall = SCMP_SYS(open); + elem->pindex = 0; + elem->ptype = PARAM_PTR; + elem->param = (intptr_t) prot_strdup((char*) file); + elem->prot = 1; - // TODO: and so on ..? - if (!strcmp(syscall, "open")) { - (*elem)->syscall = SCMP_SYS(open); - } else if (!strcmp(syscall, "rt_sigaction")) { - (*elem)->syscall = SCMP_SYS(rt_sigaction); - } + // fifo + elem->next = filter_dynamic; + filter_dynamic = elem; return 0; } @@ -294,7 +256,7 @@ static int add_param_filter(scmp_filter_ctx ctx) { int i, filter_size, rc = 0; - ParFilterDynamic *elem; + sandbox_cfg_t *elem; if (filter_static != NULL) { filter_size = sizeof(filter_static) / sizeof(filter_static[0]); diff --git a/src/common/sandbox.h b/src/common/sandbox.h index dc765c7..2cb8ab8 100644 --- a/src/common/sandbox.h +++ b/src/common/sandbox.h @@ -45,7 +45,7 @@ typedef struct { intptr_t param; char prot; -} ParFilterStatic; +} sandbox_static_cfg_t; struct pfd_elem { int syscall; @@ -58,7 +58,7 @@ struct pfd_elem { struct pfd_elem *next; }; -typedef struct pfd_elem ParFilterDynamic; +typedef struct pfd_elem sandbox_cfg_t; /** * Linux 32 bit definitions @@ -81,8 +81,7 @@ typedef struct pfd_elem ParFilterDynamic; void sandbox_set_debugging_fd(int fd); int tor_global_sandbox(void); char* get_prot_param(char *param); -int add_dynamic_param_filter(char *syscall, char ptype, char pindex, - intptr_t val); +int sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file); #endif /* SANDBOX_H_ */ diff --git a/src/or/main.c b/src/or/main.c index 618ee6e..8bcf927 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -2639,6 +2639,43 @@ find_flashcard_path(PWCHAR path, size_t size) } #endif +static int +sandbox_cfg_init_open() +{ + sandbox_cfg_allow_open_filename(NULL, + get_datadir_fname("cached-certs")); + sandbox_cfg_allow_open_filename(NULL, + get_datadir_fname("cached-consensus")); + sandbox_cfg_allow_open_filename(NULL, + get_datadir_fname("unverified-consensus")); + sandbox_cfg_allow_open_filename(NULL, + get_datadir_fname("cached-microdesc-consensus")); + sandbox_cfg_allow_open_filename(NULL, + get_datadir_fname("cached-microdesc-consensus.tmp")); + sandbox_cfg_allow_open_filename(NULL, + get_datadir_fname("cached-microdescs")); + sandbox_cfg_allow_open_filename(NULL, + get_datadir_fname("cached-microdescs.tmp")); + sandbox_cfg_allow_open_filename(NULL, + get_datadir_fname("cached-microdescs.new")); + sandbox_cfg_allow_open_filename(NULL, + get_datadir_fname("unverified-microdesc-consensus")); + sandbox_cfg_allow_open_filename(NULL, + get_datadir_fname("cached-descriptors")); + sandbox_cfg_allow_open_filename(NULL, + get_datadir_fname("cached-descriptors.new")); + sandbox_cfg_allow_open_filename(NULL, + get_datadir_fname("cached-extrainfo")); + sandbox_cfg_allow_open_filename(NULL, + get_datadir_fname("state.tmp")); + sandbox_cfg_allow_open_filename(NULL, + get_datadir_fname("unparseable-desc.tmp")); + sandbox_cfg_allow_open_filename(NULL, + get_datadir_fname("unparseable-desc")); + + return 0; +} + /** Main entry point for the Tor process. Called from main(). */ /* This function is distinct from main() only so we can link main.c into * the unittest binary without conflicting with the unittests' main. */ @@ -2707,6 +2744,9 @@ tor_main(int argc, char *argv[]) return -1; if (get_options()->Sandbox) { + if (sandbox_cfg_init_open() < 0) + return -1; + if (tor_global_sandbox()) { log_err(LD_BUG,"Failed to create syscall sandbox filter"); return -1;

1 0

[tor/master] added support for numeric parameters, tested with rt_sigaction
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit 8b12170f23f4042610b3574b8edf3794fef245b4 Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Tue Jul 23 10:49:56 2013 +0300 added support for numeric parameters, tested with rt_sigaction --- src/common/sandbox.c | 22 +++++++++++++++++----- src/common/sandbox.h | 8 +++++++- 2 files changed, 24 insertions(+), 6 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index f757c8d..7c73215 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -28,14 +28,25 @@ #include <sys/mman.h> #include <sys/syscall.h> +#include <bits/signum.h> #include <seccomp.h> #include <signal.h> #include <unistd.h> static ParFilter param_filter[] = { // Example entries - {SCMP_SYS(execve), (intptr_t)("/usr/local/bin/tor"), 0}, - {SCMP_SYS(execve), (intptr_t)("/usr/local/bin/tor"), 0} + {SCMP_SYS(execve), PARAM_PTR, (intptr_t)("/usr/local/bin/tor"), 0}, + {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGINT), 0}, + {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGTERM), 0}, + {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGPIPE), 0}, + {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGUSR1), 0}, + {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGUSR2), 0}, + {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGHUP), 0}, +#ifdef SIGXFSZ + {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGXFSZ), 0}, +#endif + {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGCHLD), 0}, + }; /** Variable used for storing all syscall numbers that will be allowed with the @@ -101,7 +112,6 @@ static int general_filter[] = { SCMP_SYS(prctl), SCMP_SYS(read), SCMP_SYS(rename), - SCMP_SYS(rt_sigaction), SCMP_SYS(rt_sigprocmask), SCMP_SYS(rt_sigreturn), #ifdef __NR_sigreturn @@ -166,7 +176,7 @@ get_prot_param(char *param) for (i = 0; i < filter_size; i++) { if (param_filter[i].prot && !strncmp(param, (char*) param_filter[i].param, - MAX_PARAM_LEN)) { + MAX_PARAM_LEN) && param_filter[i].ptype == PARAM_PTR) { return (char*)(param_filter[i].param); } } @@ -188,7 +198,7 @@ add_param_filter(scmp_filter_ctx ctx) // for each parameter filter for (i = 0; i < filter_size; i++) { - if (!param_filter[i].prot) { + if (!param_filter[i].prot && param_filter[i].ptype == PARAM_PTR) { // allocating protected memory region for parameter param_size = 1 + strnlen((char*) param_filter[i].param, MAX_PARAM_LEN); if (param_size == MAX_PARAM_LEN) { @@ -213,6 +223,8 @@ add_param_filter(scmp_filter_ctx ctx) } } // if not protected + param_filter[i].prot = 1; + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, param_filter[i].syscall, 1, SCMP_A0(SCMP_CMP_EQ, param_filter[i].param)); if (rc != 0) { diff --git a/src/common/sandbox.h b/src/common/sandbox.h index bfb7a73..de5699e 100644 --- a/src/common/sandbox.h +++ b/src/common/sandbox.h @@ -34,9 +34,15 @@ #define MAX_PARAM_LEN 32 +#define PARAM_PTR 0 +#define PARAM_NUM 1 + typedef struct { int syscall; - intptr_t param; // TODO: make this intptr_t to support multiple types + + char ptype; + intptr_t param; + char prot; } ParFilter;

1 0

[tor/master] added support for multiple parameters
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit e1410f20d749e3e76a28b7db0e99f51b863100ef Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Tue Jul 23 14:22:31 2013 +0300 added support for multiple parameters --- src/common/sandbox.c | 48 ++++++++++++++++++++++++------------------------ src/common/sandbox.h | 1 + 2 files changed, 25 insertions(+), 24 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 143995d..377ac06 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -35,44 +35,44 @@ static ParFilter param_filter[] = { // Example entries - {SCMP_SYS(execve), PARAM_PTR, (intptr_t)("/usr/local/bin/tor"), 0}, - {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGINT), 0}, - {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGTERM), 0}, - {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGPIPE), 0}, - {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGUSR1), 0}, - {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGUSR2), 0}, - {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGHUP), 0}, + {SCMP_SYS(execve), PARAM_PTR, 0, (intptr_t)("/usr/local/bin/tor"), 0}, + {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGINT), 0}, + {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGTERM), 0}, + {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGPIPE), 0}, + {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGUSR1), 0}, + {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGUSR2), 0}, + {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGHUP), 0}, #ifdef SIGXFSZ - {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGXFSZ), 0}, + {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGXFSZ), 0}, #endif - {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGCHLD), 0}, - {SCMP_SYS(open), PARAM_PTR, + {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGCHLD), 0}, + {SCMP_SYS(open), PARAM_PTR, 0, (intptr_t)("/home/cristi/.tor/cached-certs"), 0}, - {SCMP_SYS(open), PARAM_PTR, + {SCMP_SYS(open), PARAM_PTR, 0, (intptr_t)("/home/cristi/.tor/cached-consensus"), 0}, - {SCMP_SYS(open), PARAM_PTR, + {SCMP_SYS(open), PARAM_PTR, 0, (intptr_t)("/home/cristi/.tor/unverified-consensus"), 0}, - {SCMP_SYS(open), PARAM_PTR, + {SCMP_SYS(open), PARAM_PTR, 0, (intptr_t)("/home/cristi/.tor/cached-microdesc-consensus"), 0}, - {SCMP_SYS(open), PARAM_PTR, + {SCMP_SYS(open), PARAM_PTR, 0, (intptr_t)("/home/cristi/.tor/cached-microdesc-consensus.tmp"), 0}, - {SCMP_SYS(open), PARAM_PTR, + {SCMP_SYS(open), PARAM_PTR, 0, (intptr_t)("/home/cristi/.tor/cached-microdescs"), 0}, - {SCMP_SYS(open), PARAM_PTR, + {SCMP_SYS(open), PARAM_PTR, 0, (intptr_t)("/home/cristi/.tor/cached-microdescs.new"), 0}, - {SCMP_SYS(open), PARAM_PTR, + {SCMP_SYS(open), PARAM_PTR, 0, (intptr_t)("/home/cristi/.tor/unverified-microdesc-consensus"), 0}, - {SCMP_SYS(open), PARAM_PTR, + {SCMP_SYS(open), PARAM_PTR, 0, (intptr_t)("/home/cristi/.tor/cached-descriptors"), 0}, - {SCMP_SYS(open), PARAM_PTR, + {SCMP_SYS(open), PARAM_PTR, 0, (intptr_t)("/home/cristi/.tor/cached-descriptors.new"), 0}, - {SCMP_SYS(open), PARAM_PTR, + {SCMP_SYS(open), PARAM_PTR, 0, (intptr_t)("/home/cristi/.tor/cached-extrainfo"), 0}, - {SCMP_SYS(open), PARAM_PTR, + {SCMP_SYS(open), PARAM_PTR, 0, (intptr_t)("/home/cristi/.tor/state.tmp"), 0}, - {SCMP_SYS(open), PARAM_PTR, + {SCMP_SYS(open), PARAM_PTR, 0, (intptr_t)("/home/cristi/.tor/unparseable-desc.tmp"), 0}, - {SCMP_SYS(open), PARAM_PTR, + {SCMP_SYS(open), PARAM_PTR, 0, (intptr_t)("/home/cristi/.tor/unparseable-desc"), 0}, }; @@ -253,7 +253,7 @@ add_param_filter(scmp_filter_ctx ctx) param_filter[i].prot = 1; rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, param_filter[i].syscall, 1, - SCMP_A0(SCMP_CMP_EQ, param_filter[i].param)); + SCMP_CMP(param_filter[i].pindex, SCMP_CMP_EQ, param_filter[i].param)); if (rc != 0) { log_err(LD_BUG,"(Sandbox) failed to add syscall index %d, " "received libseccomp error %d", i, rc); diff --git a/src/common/sandbox.h b/src/common/sandbox.h index b973d97..b80c198 100644 --- a/src/common/sandbox.h +++ b/src/common/sandbox.h @@ -41,6 +41,7 @@ typedef struct { int syscall; char ptype; + char pindex; intptr_t param; char prot;

1 0