September 2013 - tor-commits - lists.torproject.org

[tor/master] Changes as suggested by nickm
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit 6d5b0367f6e0035f99570b5bb76a75322ae9a85e Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Mon Jul 29 14:46:47 2013 +0300 Changes as suggested by nickm - char* to const char* and name refactoring - workaround for accept4 syscall --- src/common/compat.c | 2 +- src/common/sandbox.c | 15 +++++++-------- src/common/sandbox.h | 2 +- 3 files changed, 9 insertions(+), 10 deletions(-) diff --git a/src/common/compat.c b/src/common/compat.c index 5b15367..47b65d3 100644 --- a/src/common/compat.c +++ b/src/common/compat.c @@ -125,7 +125,7 @@ tor_open_cloexec(const char *path, int flags, unsigned mode) { int fd; #ifdef O_CLOEXEC - path = get_prot_param(path); + path = sandbox_intern_string(path); fd = open(path, flags|O_CLOEXEC, mode); if (fd >= 0) return fd; diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 4a3faa4..2e8467d 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -49,6 +49,10 @@ static sandbox_static_cfg_t filter_static[] = { #endif {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGCHLD), 0}, {SCMP_SYS(time), PARAM_NUM, 0, 0, 0}, + +#ifdef __NR_socketcall + {SCMP_SYS(socketcall), PARAM_NUM, 0, 18, 0}, // accept4 workaround +#endif }; /** Variable used for storing all syscall numbers that will be allowed with the @@ -136,7 +140,7 @@ static int filter_nopar_gen[] = { SCMP_SYS(exit), // socket syscalls - SCMP_SYS(accept4), +// SCMP_SYS(accept4), SCMP_SYS(bind), SCMP_SYS(connect), SCMP_SYS(getsockname), @@ -149,17 +153,12 @@ static int filter_nopar_gen[] = { SCMP_SYS(setsockopt), SCMP_SYS(socket), SCMP_SYS(socketpair), - -#ifdef __NR_socketcall -// SCMP_SYS(socketcall), -#endif - SCMP_SYS(recvfrom), SCMP_SYS(unlink), }; -char* -get_prot_param(char *param) +const char* +sandbox_intern_string(char *param) { int i, filter_size; sandbox_cfg_t *elem; diff --git a/src/common/sandbox.h b/src/common/sandbox.h index c6d8065..9acf8c4 100644 --- a/src/common/sandbox.h +++ b/src/common/sandbox.h @@ -80,7 +80,7 @@ typedef struct pfd_elem sandbox_cfg_t; void sandbox_set_debugging_fd(int fd); int tor_global_sandbox(void); -char* get_prot_param(char *param); +const char* sandbox_intern_string(char *param); sandbox_cfg_t * sandbox_cfg_new(); int sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file);

1 0

[tor/master] Investigated access4 syscall problem, small changes to filter.
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit 8f9d3da19447f138bc451937b20537810926ff30 Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Fri Jul 26 19:53:05 2013 +0300 Investigated access4 syscall problem, small changes to filter. --- src/common/sandbox.c | 20 +++++++++----------- src/or/main.c | 2 ++ 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index ce6b63c..4a3faa4 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -48,10 +48,16 @@ static sandbox_static_cfg_t filter_static[] = { {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGXFSZ), 0}, #endif {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGCHLD), 0}, + {SCMP_SYS(time), PARAM_NUM, 0, 0, 0}, }; /** Variable used for storing all syscall numbers that will be allowed with the * stage 1 general Tor sandbox. + * + * todo: + * read, write, close - rely on fd + * + * */ static int filter_nopar_gen[] = { SCMP_SYS(access), @@ -124,7 +130,6 @@ static int filter_nopar_gen[] = { #ifdef __NR_stat64 SCMP_SYS(stat64), #endif - SCMP_SYS(time), SCMP_SYS(uname), SCMP_SYS(write), SCMP_SYS(exit_group), @@ -137,27 +142,20 @@ static int filter_nopar_gen[] = { SCMP_SYS(getsockname), SCMP_SYS(getsockopt), SCMP_SYS(listen), -#if __NR_recv >= 0 - /* This is a kludge; It's necessary on 64-bit with libseccomp 1.0.0; I - * don't know if other 64-bit or other versions require it. */ SCMP_SYS(recv), -#endif SCMP_SYS(recvmsg), -#if __NR_send >= 0 - SCMP_SYS(send), -#endif SCMP_SYS(sendto), + SCMP_SYS(send), SCMP_SYS(setsockopt), SCMP_SYS(socket), SCMP_SYS(socketpair), - // TODO: remove when accept4 is fixed #ifdef __NR_socketcall - SCMP_SYS(socketcall), +// SCMP_SYS(socketcall), #endif SCMP_SYS(recvfrom), - SCMP_SYS(unlink) + SCMP_SYS(unlink), }; char* diff --git a/src/or/main.c b/src/or/main.c index 978c171..269d3fd 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -2661,6 +2661,8 @@ sandbox_init_filter() sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname("cached-microdescs.new")); sandbox_cfg_allow_open_filename(&cfg, + get_datadir_fname("cached-microdescs.new.tmp")); + sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname("unverified-microdesc-consensus")); sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname("cached-descriptors"));

1 0

[tor/master] integrated context for dynamic filters
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit 626a2b23de006154b6cb3fa334a97dc547d56a98 Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Thu Jul 25 14:08:02 2013 +0300 integrated context for dynamic filters --- src/common/sandbox.c | 48 +++++++++++++++++++++++++++++++++++------------- src/common/sandbox.h | 3 +++ src/or/main.c | 43 ++++++++++++++++++++++--------------------- 3 files changed, 60 insertions(+), 34 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index a4afc36..ce6b63c 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -228,12 +228,6 @@ prot_strdup(char* str) return res; } -sandbox_cfg_t* -sandbox_cfg_new() -{ - return NULL; -} - int sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file) { @@ -253,7 +247,7 @@ sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file) } static int -add_param_filter(scmp_filter_ctx ctx) +add_param_filter(scmp_filter_ctx ctx, sandbox_cfg_t* cfg) { int i, filter_size, rc = 0; sandbox_cfg_t *elem; @@ -265,7 +259,8 @@ add_param_filter(scmp_filter_ctx ctx) } // for each dynamic parameter filters - for (elem = filter_dynamic; elem != NULL; elem = elem->next) { + elem = (cfg == NULL) ? filter_dynamic : cfg; + for (; elem != NULL; elem = elem->next) { rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, elem->syscall, 1, SCMP_CMP(elem->pindex, SCMP_CMP_EQ, elem->param)); if (rc != 0) { @@ -327,7 +322,7 @@ add_noparam_filter(scmp_filter_ctx ctx) * Returns 0 on success. */ static int -install_glob_syscall_filter(void) +install_syscall_filter(sandbox_cfg_t* cfg) { int rc = 0; scmp_filter_ctx ctx; @@ -340,7 +335,7 @@ install_glob_syscall_filter(void) } // add parameter filters - if ((rc = add_param_filter(ctx))) { + if ((rc = add_param_filter(ctx, cfg))) { log_err(LD_BUG, "(Sandbox) failed to add param filters!"); goto end; } @@ -450,12 +445,12 @@ install_sigsys_debugging(void) * into account various available features for different linux flavours. */ static int -initialise_libseccomp_sandbox(void) +initialise_libseccomp_sandbox(sandbox_cfg_t* cfg) { if (install_sigsys_debugging()) return -1; - if (install_glob_syscall_filter()) + if (install_syscall_filter(cfg)) return -2; return 0; @@ -463,6 +458,33 @@ initialise_libseccomp_sandbox(void) #endif // USE_LIBSECCOMP +sandbox_cfg_t* +sandbox_cfg_new() { + return NULL; +} + +int +sandbox_init(sandbox_cfg_t* cfg) +{ +#if defined(USE_LIBSECCOMP) + return initialise_libseccomp_sandbox(cfg); + +#elif defined(_WIN32) + log_warn(LD_BUG,"Windows sandboxing is not implemented. The feature is " + "currently disabled."); + return 0; + +#elif defined(TARGET_OS_MAC) + log_warn(LD_BUG,"Mac OSX sandboxing is not implemented. The feature is " + "currently disabled"); + return 0; +#else + log_warn(LD_BUG,"Sandboxing is not implemented for your platform. The " + "feature is currently disabled"); + return 0; +#endif +} + /** * Enables the stage 1 general sandbox. It applies a syscall filter which does * not restrict any Tor features. The filter is representative for the whole @@ -473,7 +495,7 @@ tor_global_sandbox(void) { #if defined(USE_LIBSECCOMP) - return initialise_libseccomp_sandbox(); + return initialise_libseccomp_sandbox(NULL); #elif defined(_WIN32) log_warn(LD_BUG,"Windows sandboxing is not implemented. The feature is " diff --git a/src/common/sandbox.h b/src/common/sandbox.h index 2cb8ab8..c6d8065 100644 --- a/src/common/sandbox.h +++ b/src/common/sandbox.h @@ -81,7 +81,10 @@ typedef struct pfd_elem sandbox_cfg_t; void sandbox_set_debugging_fd(int fd); int tor_global_sandbox(void); char* get_prot_param(char *param); + +sandbox_cfg_t * sandbox_cfg_new(); int sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file); +int sandbox_init(sandbox_cfg_t* cfg); #endif /* SANDBOX_H_ */ diff --git a/src/or/main.c b/src/or/main.c index 8bcf927..978c171 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -2639,41 +2639,43 @@ find_flashcard_path(PWCHAR path, size_t size) } #endif -static int -sandbox_cfg_init_open() +static sandbox_cfg_t* +sandbox_init_filter() { - sandbox_cfg_allow_open_filename(NULL, + sandbox_cfg_t *cfg = sandbox_cfg_new(); + + sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname("cached-certs")); - sandbox_cfg_allow_open_filename(NULL, + sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname("cached-consensus")); - sandbox_cfg_allow_open_filename(NULL, + sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname("unverified-consensus")); - sandbox_cfg_allow_open_filename(NULL, + sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname("cached-microdesc-consensus")); - sandbox_cfg_allow_open_filename(NULL, + sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname("cached-microdesc-consensus.tmp")); - sandbox_cfg_allow_open_filename(NULL, + sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname("cached-microdescs")); - sandbox_cfg_allow_open_filename(NULL, + sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname("cached-microdescs.tmp")); - sandbox_cfg_allow_open_filename(NULL, + sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname("cached-microdescs.new")); - sandbox_cfg_allow_open_filename(NULL, + sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname("unverified-microdesc-consensus")); - sandbox_cfg_allow_open_filename(NULL, + sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname("cached-descriptors")); - sandbox_cfg_allow_open_filename(NULL, + sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname("cached-descriptors.new")); - sandbox_cfg_allow_open_filename(NULL, + sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname("cached-extrainfo")); - sandbox_cfg_allow_open_filename(NULL, + sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname("state.tmp")); - sandbox_cfg_allow_open_filename(NULL, + sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname("unparseable-desc.tmp")); - sandbox_cfg_allow_open_filename(NULL, + sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname("unparseable-desc")); - return 0; + return cfg; } /** Main entry point for the Tor process. Called from main(). */ @@ -2744,10 +2746,9 @@ tor_main(int argc, char *argv[]) return -1; if (get_options()->Sandbox) { - if (sandbox_cfg_init_open() < 0) - return -1; + sandbox_cfg_t* cfg = sandbox_init_filter(); - if (tor_global_sandbox()) { + if (sandbox_init(cfg)) { log_err(LD_BUG,"Failed to create syscall sandbox filter"); return -1; }

1 0

[tor/master] added openat parameter filter
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit 8022def6f05bf40e1c6e0fd15d77ed0ecf5c3406 Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Mon Jul 29 16:30:39 2013 +0300 added openat parameter filter --- src/common/sandbox.c | 19 ++++++++++++++----- src/common/sandbox.h | 4 +++- src/common/util.c | 4 +++- src/or/main.c | 2 ++ 4 files changed, 22 insertions(+), 7 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 2e8467d..efadeca 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -117,7 +117,6 @@ static int filter_nopar_gen[] = { SCMP_SYS(mprotect), SCMP_SYS(mremap), SCMP_SYS(munmap), - SCMP_SYS(openat), SCMP_SYS(poll), SCMP_SYS(prctl), SCMP_SYS(read), @@ -158,7 +157,7 @@ static int filter_nopar_gen[] = { }; const char* -sandbox_intern_string(char *param) +sandbox_intern_string(const char *param) { int i, filter_size; sandbox_cfg_t *elem; @@ -228,15 +227,25 @@ prot_strdup(char* str) int sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file) { - sandbox_cfg_t *elem = (sandbox_cfg_t*) malloc(sizeof(sandbox_cfg_t)); + sandbox_cfg_t *elem = NULL; + intptr_t prot_str = (intptr_t) prot_strdup((char*) file); + elem = (sandbox_cfg_t*) malloc(sizeof(sandbox_cfg_t)); elem->syscall = SCMP_SYS(open); elem->pindex = 0; elem->ptype = PARAM_PTR; - elem->param = (intptr_t) prot_strdup((char*) file); + elem->param = prot_str; elem->prot = 1; + elem->next = filter_dynamic; + filter_dynamic = elem; - // fifo + // also allow openat + elem = (sandbox_cfg_t*) malloc(sizeof(sandbox_cfg_t)); + elem->syscall = SCMP_SYS(openat); + elem->pindex = 1; + elem->ptype = PARAM_PTR; + elem->param = prot_str; + elem->prot = 1; elem->next = filter_dynamic; filter_dynamic = elem; diff --git a/src/common/sandbox.h b/src/common/sandbox.h index 9acf8c4..104d832 100644 --- a/src/common/sandbox.h +++ b/src/common/sandbox.h @@ -29,7 +29,9 @@ */ #ifdef __linux__ +#ifndef __USE_GNU #define __USE_GNU +#endif #include <sys/ucontext.h> #define MAX_PARAM_LEN 64 @@ -80,7 +82,7 @@ typedef struct pfd_elem sandbox_cfg_t; void sandbox_set_debugging_fd(int fd); int tor_global_sandbox(void); -const char* sandbox_intern_string(char *param); +const char* sandbox_intern_string(const char *param); sandbox_cfg_t * sandbox_cfg_new(); int sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file); diff --git a/src/common/util.c b/src/common/util.c index 651554e..75462b6 100644 --- a/src/common/util.c +++ b/src/common/util.c @@ -24,6 +24,7 @@ #include "torint.h" #include "container.h" #include "address.h" +#include "../common/sandbox.h" #ifdef _WIN32 #include <io.h> @@ -3042,6 +3043,7 @@ smartlist_t * tor_listdir(const char *dirname) { smartlist_t *result; + const char *prot_dname = sandbox_intern_string(dirname); #ifdef _WIN32 char *pattern=NULL; TCHAR tpattern[MAX_PATH] = {0}; @@ -3085,7 +3087,7 @@ tor_listdir(const char *dirname) #else DIR *d; struct dirent *de; - if (!(d = opendir(dirname))) + if (!(d = opendir(prot_dname))) return NULL; result = smartlist_new(); diff --git a/src/or/main.c b/src/or/main.c index 269d3fd..d50f239 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -2645,6 +2645,8 @@ sandbox_init_filter() sandbox_cfg_t *cfg = sandbox_cfg_new(); sandbox_cfg_allow_open_filename(&cfg, + get_datadir_fname("cached-status")); + sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname("cached-certs")); sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname("cached-consensus"));

1 0

[tor/master] removed open flags (postponed), added mmap2 flags
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit 5baea851892bcc2734c0e62e96b8d2d6e2626c51 Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Tue Jul 30 19:37:28 2013 +0300 removed open flags (postponed), added mmap2 flags --- src/common/sandbox.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 8e7796b..b55586b 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -58,7 +58,13 @@ static sandbox_static_cfg_t filter_static[] = { {SCMP_SYS(socketcall), PARAM_NUM, 0, 18, 0}, #endif - {SCMP_SYS(open), PARAM_NUM, 1, O_RDONLY | O_CLOEXEC, 0} +#ifdef __NR_mmap2 + {SCMP_SYS(mmap2), PARAM_NUM, 2, PROT_READ, 0}, + {SCMP_SYS(mmap2), PARAM_NUM, 2, PROT_READ|PROT_WRITE, 0}, + {SCMP_SYS(mmap2), PARAM_NUM, 3, MAP_PRIVATE|MAP_ANONYMOUS, 0}, + {SCMP_SYS(mmap2), PARAM_NUM, 3, MAP_PRIVATE, 0}, +#endif + }; /** Variable used for storing all syscall numbers that will be allowed with the @@ -111,9 +117,6 @@ static int filter_nopar_gen[] = { SCMP_SYS(mkdir), SCMP_SYS(mlockall), SCMP_SYS(mmap), -#ifdef __NR_mmap2 - SCMP_SYS(mmap2), -#endif SCMP_SYS(mprotect), SCMP_SYS(mremap), SCMP_SYS(munmap),

1 0

[tor/master] small filter changes; openat as separate function
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit 871e5b35a89ae02f92b64af0afb058fae9c41f43 Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Tue Jul 30 19:09:28 2013 +0300 small filter changes; openat as separate function --- src/common/sandbox.c | 32 +++++++++++++++++++------------- src/common/sandbox.h | 1 + src/or/main.c | 3 ++- 3 files changed, 22 insertions(+), 14 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index efadeca..8e7796b 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -26,17 +26,21 @@ #if defined(USE_LIBSECCOMP) +#define _GNU_SOURCE + #include <sys/mman.h> #include <sys/syscall.h> +#include <sys/types.h> #include <bits/signum.h> + #include <seccomp.h> #include <signal.h> #include <unistd.h> +#include <fcntl.h> sandbox_cfg_t *filter_dynamic = NULL; static sandbox_static_cfg_t filter_static[] = { - // Example entries {SCMP_SYS(execve), PARAM_PTR, 0, (intptr_t)("/usr/local/bin/tor"), 0}, {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGINT), 0}, {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGTERM), 0}, @@ -49,19 +53,16 @@ static sandbox_static_cfg_t filter_static[] = { #endif {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGCHLD), 0}, {SCMP_SYS(time), PARAM_NUM, 0, 0, 0}, - + // accept4 workaround #ifdef __NR_socketcall - {SCMP_SYS(socketcall), PARAM_NUM, 0, 18, 0}, // accept4 workaround + {SCMP_SYS(socketcall), PARAM_NUM, 0, 18, 0}, #endif + + {SCMP_SYS(open), PARAM_NUM, 1, O_RDONLY | O_CLOEXEC, 0} }; /** Variable used for storing all syscall numbers that will be allowed with the * stage 1 general Tor sandbox. - * - * todo: - * read, write, close - rely on fd - * - * */ static int filter_nopar_gen[] = { SCMP_SYS(access), @@ -72,7 +73,6 @@ static int filter_nopar_gen[] = { SCMP_SYS(epoll_create), SCMP_SYS(epoll_ctl), SCMP_SYS(epoll_wait), - SCMP_SYS(execve), SCMP_SYS(fcntl), #ifdef __NR_fcntl64 /* Older libseccomp versions don't define PNR entries for all of these, @@ -228,23 +228,29 @@ int sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file) { sandbox_cfg_t *elem = NULL; - intptr_t prot_str = (intptr_t) prot_strdup((char*) file); elem = (sandbox_cfg_t*) malloc(sizeof(sandbox_cfg_t)); elem->syscall = SCMP_SYS(open); elem->pindex = 0; elem->ptype = PARAM_PTR; - elem->param = prot_str; + elem->param = (intptr_t) prot_strdup((char*) file); elem->prot = 1; elem->next = filter_dynamic; filter_dynamic = elem; - // also allow openat + return 0; +} + +int +sandbox_cfg_allow_openat_filename(sandbox_cfg_t **cfg, char *file) +{ + sandbox_cfg_t *elem = NULL; + elem = (sandbox_cfg_t*) malloc(sizeof(sandbox_cfg_t)); elem->syscall = SCMP_SYS(openat); elem->pindex = 1; elem->ptype = PARAM_PTR; - elem->param = prot_str; + elem->param = (intptr_t) prot_strdup((char*) file);; elem->prot = 1; elem->next = filter_dynamic; filter_dynamic = elem; diff --git a/src/common/sandbox.h b/src/common/sandbox.h index 104d832..dbf743e 100644 --- a/src/common/sandbox.h +++ b/src/common/sandbox.h @@ -86,6 +86,7 @@ const char* sandbox_intern_string(const char *param); sandbox_cfg_t * sandbox_cfg_new(); int sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file); +int sandbox_cfg_allow_openat_filename(sandbox_cfg_t **cfg, char *file); int sandbox_init(sandbox_cfg_t* cfg); #endif /* SANDBOX_H_ */ diff --git a/src/or/main.c b/src/or/main.c index d50f239..ab7b6ec 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -2644,8 +2644,9 @@ sandbox_init_filter() { sandbox_cfg_t *cfg = sandbox_cfg_new(); - sandbox_cfg_allow_open_filename(&cfg, + sandbox_cfg_allow_openat_filename(&cfg, get_datadir_fname("cached-status")); + sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname("cached-certs")); sandbox_cfg_allow_open_filename(&cfg,

1 0

[tor/master] clean stable version
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit 686cf4c0fffa5af63bf989eb53af9a962692670a Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Tue Jul 30 23:43:42 2013 +0300 clean stable version --- src/common/sandbox.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index d13938d..8a31ce0 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -127,6 +127,7 @@ static int filter_nopar_gen[] = { SCMP_SYS(sendto), SCMP_SYS(send), SCMP_SYS(setsockopt), + SCMP_SYS(socket), SCMP_SYS(socketpair), SCMP_SYS(recvfrom), SCMP_SYS(unlink), @@ -142,10 +143,10 @@ sb_rt_sigaction(scmp_filter_ctx ctx) #endif }; - for(i = 0; i < LENGHT(param); i++) { + for (i = 0; i < LENGHT(param); i++) { rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(rt_sigaction), 1, SCMP_CMP(0, SCMP_CMP_EQ, param[i])); - if(rc) + if (rc) break; } @@ -198,14 +199,14 @@ sb_mmap2(scmp_filter_ctx ctx) rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mmap2), 2, SCMP_CMP(2, SCMP_CMP_EQ, PROT_READ), SCMP_CMP(3, SCMP_CMP_EQ, MAP_PRIVATE)); - if(rc) { + if (rc) { return rc; } rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mmap2), 2, SCMP_CMP(2, SCMP_CMP_EQ, PROT_READ|PROT_WRITE), SCMP_CMP(3, SCMP_CMP_EQ, MAP_PRIVATE|MAP_ANONYMOUS)); - if(rc) { + if (rc) { return rc; } @@ -398,7 +399,7 @@ add_param_filter(scmp_filter_ctx ctx, sandbox_cfg_t* cfg) int i, rc = 0; // function pointer - for(i = 0; i < LENGHT(filter_func); i++) { + for (i = 0; i < LENGHT(filter_func); i++) { if ((filter_func[i])(ctx)) { log_err(LD_BUG,"(Sandbox) failed to add syscall, received libseccomp " "error %d", rc); @@ -576,7 +577,8 @@ initialise_libseccomp_sandbox(sandbox_cfg_t* cfg) #endif // USE_LIBSECCOMP sandbox_cfg_t* -sandbox_cfg_new() { +sandbox_cfg_new() +{ return NULL; }

1 0

[tor/master] switched to a design using filters as function pointer arrays
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit 442f256f251d1a7a0c29c4d1254dda668f887d0c Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Tue Jul 30 21:23:30 2013 +0300 switched to a design using filters as function pointer arrays --- src/common/sandbox.c | 220 +++++++++++++++++++++++++++++++++----------------- src/common/sandbox.h | 3 + 2 files changed, 148 insertions(+), 75 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index b55586b..28f23e8 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -18,6 +18,8 @@ #include "orconfig.h" #include "torint.h" +#define LENGHT(x) (sizeof(x)) / sizeof(x[0]) + #if defined(HAVE_SECCOMP_H) && defined(__linux__) #define USE_LIBSECCOMP #endif @@ -40,33 +42,6 @@ sandbox_cfg_t *filter_dynamic = NULL; -static sandbox_static_cfg_t filter_static[] = { - {SCMP_SYS(execve), PARAM_PTR, 0, (intptr_t)("/usr/local/bin/tor"), 0}, - {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGINT), 0}, - {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGTERM), 0}, - {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGPIPE), 0}, - {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGUSR1), 0}, - {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGUSR2), 0}, - {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGHUP), 0}, -#ifdef SIGXFSZ - {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGXFSZ), 0}, -#endif - {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGCHLD), 0}, - {SCMP_SYS(time), PARAM_NUM, 0, 0, 0}, - // accept4 workaround -#ifdef __NR_socketcall - {SCMP_SYS(socketcall), PARAM_NUM, 0, 18, 0}, -#endif - -#ifdef __NR_mmap2 - {SCMP_SYS(mmap2), PARAM_NUM, 2, PROT_READ, 0}, - {SCMP_SYS(mmap2), PARAM_NUM, 2, PROT_READ|PROT_WRITE, 0}, - {SCMP_SYS(mmap2), PARAM_NUM, 3, MAP_PRIVATE|MAP_ANONYMOUS, 0}, - {SCMP_SYS(mmap2), PARAM_NUM, 3, MAP_PRIVATE, 0}, -#endif - -}; - /** Variable used for storing all syscall numbers that will be allowed with the * stage 1 general Tor sandbox. */ @@ -159,28 +134,139 @@ static int filter_nopar_gen[] = { SCMP_SYS(unlink), }; -const char* -sandbox_intern_string(const char *param) -{ - int i, filter_size; +static int sb_rt_sigaction(scmp_filter_ctx ctx) { + int i, rc; + int param[] = { SIGINT, SIGTERM, SIGPIPE, SIGUSR1, SIGUSR2, SIGHUP, SIGCHLD, +#ifdef SIGXFSZ + SIGXFSZ +#endif + }; + + for(i = 0; i < LENGHT(param); i++) { + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(rt_sigaction), 1, + SCMP_CMP(0, SCMP_CMP_EQ, param[i])); + if(rc) + break; + } + + return rc; +} + +static int sb_execve(scmp_filter_ctx ctx) { + int rc; sandbox_cfg_t *elem; - if (param == NULL) - return NULL; + // for each dynamic parameter filters + elem = filter_dynamic; + for (; elem != NULL; elem = elem->next) { + if (elem->prot == 1 && elem->syscall == SCMP_SYS(execve)) { + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(execve), 1, + SCMP_CMP(0, SCMP_CMP_EQ, elem->param)); + if (rc != 0) { + log_err(LD_BUG,"(Sandbox) failed to add syscall, received libseccomp " + "error %d", rc); + return rc; + } + } + } - if (filter_static == NULL) { - filter_size = 0; - } else { - filter_size = sizeof(filter_static) / sizeof(filter_static[0]); + return 0; +} + +static int sb_time(scmp_filter_ctx ctx) { + return seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(time), 1, + SCMP_CMP(0, SCMP_CMP_EQ, 0)); +} + +static int sb_accept4(scmp_filter_ctx ctx) { + return seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socketcall), 1, + SCMP_CMP(0, SCMP_CMP_EQ, 18)); +} + +#ifdef __NR_mmap2 +static int sb_mmap2(scmp_filter_ctx ctx) { + int rc = 0; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mmap2), 2, + SCMP_CMP(2, SCMP_CMP_EQ, PROT_READ), + SCMP_CMP(3, SCMP_CMP_EQ, MAP_PRIVATE)); + if(rc) { + return rc; } - for (i = 0; i < filter_size; i++) { - if (filter_static[i].prot && filter_static[i].ptype == PARAM_PTR - && !strncmp(param, (char*)(filter_static[i].param), MAX_PARAM_LEN)) { - return (char*)(filter_static[i].param); + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mmap2), 2, + SCMP_CMP(2, SCMP_CMP_EQ, PROT_READ|PROT_WRITE), + SCMP_CMP(3, SCMP_CMP_EQ, MAP_PRIVATE|MAP_ANONYMOUS)); + if(rc) { + return rc; + } + + return 0; +} +#endif + +// TODO parameters +static int sb_open(scmp_filter_ctx ctx) { + int rc; + sandbox_cfg_t *elem; + + // for each dynamic parameter filters + elem = filter_dynamic; + for (; elem != NULL; elem = elem->next) { + if (elem->prot == 1 && elem->syscall == SCMP_SYS(open)) { + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(open), 1, + SCMP_CMP(0, SCMP_CMP_EQ, elem->param)); + if (rc != 0) { + log_err(LD_BUG,"(Sandbox) failed to add syscall, received libseccomp " + "error %d", rc); + return rc; + } + } + } + + return 0; +} + +// TODO parameters +static int sb_openat(scmp_filter_ctx ctx) { + int rc; + sandbox_cfg_t *elem; + + // for each dynamic parameter filters + elem = filter_dynamic; + for (; elem != NULL; elem = elem->next) { + if (elem->prot == 1 && elem->syscall == SCMP_SYS(openat)) { + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(openat), 1, + SCMP_CMP(1, SCMP_CMP_EQ, elem->param)); + if (rc != 0) { + log_err(LD_BUG,"(Sandbox) failed to add syscall, received libseccomp " + "error %d", rc); + return rc; + } } } + return 0; +} + +static sandbox_filter_func_t filter_func[] = { + sb_rt_sigaction, + sb_execve, + sb_time, + sb_accept4, + sb_mmap2, + sb_open, + sb_openat +}; + +const char* +sandbox_intern_string(const char *param) +{ + sandbox_cfg_t *elem; + + if (param == NULL) + return NULL; + for (elem = filter_dynamic; elem != NULL; elem = elem->next) { if (elem->prot && elem->ptype == PARAM_PTR && !strncmp(param, (char*)(elem->param), MAX_PARAM_LEN)) { @@ -264,46 +350,30 @@ sandbox_cfg_allow_openat_filename(sandbox_cfg_t **cfg, char *file) static int add_param_filter(scmp_filter_ctx ctx, sandbox_cfg_t* cfg) { - int i, filter_size, rc = 0; + int i, rc = 0; sandbox_cfg_t *elem; - if (filter_static != NULL) { - filter_size = sizeof(filter_static) / sizeof(filter_static[0]); - } else { - filter_size = 0; - } - - // for each dynamic parameter filters - elem = (cfg == NULL) ? filter_dynamic : cfg; - for (; elem != NULL; elem = elem->next) { - rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, elem->syscall, 1, - SCMP_CMP(elem->pindex, SCMP_CMP_EQ, elem->param)); - if (rc != 0) { - log_err(LD_BUG,"(Sandbox) failed to add syscall, received libseccomp " - "error %d", rc); - return rc; - } - } - - // for each static parameter filter - for (i = 0; i < filter_size; i++) { - if (!filter_static[i].prot && filter_static[i].ptype == PARAM_PTR) { - filter_static[i].param = (intptr_t) prot_strdup( - (char*) (filter_static[i].param)); - } - - filter_static[i].prot = 1; - - rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, filter_static[i].syscall, 1, - SCMP_CMP(filter_static[i].pindex, SCMP_CMP_EQ, - filter_static[i].param)); - if (rc != 0) { - log_err(LD_BUG,"(Sandbox) failed to add syscall index %d, " - "received libseccomp error %d", i, rc); + // function pointer + for(i = 0; i < LENGHT(filter_func); i++) { + if ((filter_func[i])(ctx)) { + log_err(LD_BUG,"(Sandbox) failed to add syscall, received libseccomp " + "error %d", rc); return rc; } } +// // for each dynamic parameter filters +// elem = (cfg == NULL) ? filter_dynamic : cfg; +// for (; elem != NULL; elem = elem->next) { +// rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, elem->syscall, 1, +// SCMP_CMP(elem->pindex, SCMP_CMP_EQ, elem->param)); +// if (rc != 0) { +// log_err(LD_BUG,"(Sandbox) failed to add syscall, received libseccomp " +// "error %d", rc); +// return rc; +// } +// } + return 0; } diff --git a/src/common/sandbox.h b/src/common/sandbox.h index dbf743e..4344134 100644 --- a/src/common/sandbox.h +++ b/src/common/sandbox.h @@ -33,6 +33,7 @@ #define __USE_GNU #endif #include <sys/ucontext.h> +#include <seccomp.h> #define MAX_PARAM_LEN 64 @@ -62,6 +63,8 @@ struct pfd_elem { }; typedef struct pfd_elem sandbox_cfg_t; +typedef int (*sandbox_filter_func_t)(scmp_filter_ctx ctx); + /** * Linux 32 bit definitions */

1 0

[tor/master] fcntl64
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit 5fc0e13db821b76c2bdee06c8622a95383d1b915 Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Tue Jul 30 23:52:54 2013 +0300 fcntl64 --- src/common/sandbox.c | 43 ++++++++++++++++++++++++++++++++++++++----- 1 file changed, 38 insertions(+), 5 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 8a31ce0..acf3038 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -55,11 +55,7 @@ static int filter_nopar_gen[] = { SCMP_SYS(epoll_ctl), SCMP_SYS(epoll_wait), SCMP_SYS(fcntl), -#ifdef __NR_fcntl64 - /* Older libseccomp versions don't define PNR entries for all of these, - * so we need to ifdef them here.*/ - SCMP_SYS(fcntl64), -#endif + SCMP_SYS(flock), SCMP_SYS(fstat), #ifdef __NR_fstat64 @@ -294,6 +290,42 @@ sb_socket(scmp_filter_ctx ctx) return 0; } +// TODO: param not working +static int +sb_setsockopt(scmp_filter_ctx ctx) +{ + int rc = 0; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt), 2, + SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET), + SCMP_CMP(2, SCMP_CMP_EQ, SO_REUSEADDR)); + if (rc) + return rc; + + return 0; +} + +#ifdef __NR_fcntl64 +static int +sb_fcntl64(scmp_filter_ctx ctx) +{ + int rc = 0; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(fcntl64), 1, + SCMP_CMP(1, SCMP_CMP_EQ, F_GETFL)); + if (rc) + return rc; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(fcntl64), 2, + SCMP_CMP(1, SCMP_CMP_EQ, F_SETFL), + SCMP_CMP(2, SCMP_CMP_EQ, O_RDWR|O_NONBLOCK)); + if (rc) + return rc; + + return 0; +} +#endif + static sandbox_filter_func_t filter_func[] = { sb_rt_sigaction, sb_execve, @@ -303,6 +335,7 @@ static sandbox_filter_func_t filter_func[] = { sb_open, sb_openat, sb_clock_gettime, + sb_fcntl64 }; const char*

1 0

[tor/master] epoll_ctl
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit f0840ed4c9f17f199d73b8b9788b08af0265026d Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Wed Jul 31 00:27:14 2013 +0300 epoll_ctl --- src/common/sandbox.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index acf3038..6de95da 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -33,6 +33,7 @@ #include <sys/mman.h> #include <sys/syscall.h> #include <sys/types.h> +#include <sys/epoll.h> #include <bits/signum.h> #include <seccomp.h> @@ -52,7 +53,6 @@ static int filter_nopar_gen[] = { SCMP_SYS(close), SCMP_SYS(clone), SCMP_SYS(epoll_create), - SCMP_SYS(epoll_ctl), SCMP_SYS(epoll_wait), SCMP_SYS(fcntl), @@ -326,6 +326,24 @@ sb_fcntl64(scmp_filter_ctx ctx) } #endif +static int +sb_epoll_ctl(scmp_filter_ctx ctx) +{ + int rc = 0; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(epoll_ctl), 1, + SCMP_CMP(1, SCMP_CMP_EQ, EPOLL_CTL_ADD)); + if (rc) + return rc; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(epoll_ctl), 1, + SCMP_CMP(1, SCMP_CMP_EQ, EPOLL_CTL_MOD)); + if (rc) + return rc; + + return 0; +} + static sandbox_filter_func_t filter_func[] = { sb_rt_sigaction, sb_execve, @@ -335,7 +353,8 @@ static sandbox_filter_func_t filter_func[] = { sb_open, sb_openat, sb_clock_gettime, - sb_fcntl64 + sb_fcntl64, + sb_epoll_ctl }; const char*

1 0