September 2013 - tor-commits - lists.torproject.org

[tor/master] added execve and multi-configuration support
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit 356b646976b80c0ca1d582227d625130e7e76755 Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Mon Aug 5 15:40:23 2013 +0300 added execve and multi-configuration support --- src/common/sandbox.c | 101 ++++++++++++++++++++++++++++++-------------------- src/common/sandbox.h | 4 +- src/or/main.c | 4 ++ 3 files changed, 67 insertions(+), 42 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index e35f51f..ed7fe3b 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -126,7 +126,7 @@ static int filter_nopar_gen[] = { }; static int -sb_rt_sigaction(scmp_filter_ctx ctx) +sb_rt_sigaction(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int i, rc; int param[] = { SIGINT, SIGTERM, SIGPIPE, SIGUSR1, SIGUSR2, SIGHUP, SIGCHLD, @@ -146,19 +146,18 @@ sb_rt_sigaction(scmp_filter_ctx ctx) } static int -sb_execve(scmp_filter_ctx ctx) +sb_execve(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc; - sandbox_cfg_t *elem; + sandbox_cfg_t *elem = NULL; // for each dynamic parameter filters - elem = filter_dynamic; - for (; elem != NULL; elem = elem->next) { + for (elem = filter; elem != NULL; elem = elem->next) { if (elem->prot == 1 && elem->syscall == SCMP_SYS(execve)) { rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(execve), 1, SCMP_CMP(0, SCMP_CMP_EQ, elem->param)); if (rc != 0) { - log_err(LD_BUG,"(Sandbox) failed to add syscall, received libseccomp " + log_err(LD_BUG,"(Sandbox) failed to add execve syscall, received libseccomp " "error %d", rc); return rc; } @@ -169,14 +168,14 @@ sb_execve(scmp_filter_ctx ctx) } static int -sb_time(scmp_filter_ctx ctx) +sb_time(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { return seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(time), 1, SCMP_CMP(0, SCMP_CMP_EQ, 0)); } static int -sb_accept4(scmp_filter_ctx ctx) +sb_accept4(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { return seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socketcall), 1, SCMP_CMP(0, SCMP_CMP_EQ, 18)); @@ -184,7 +183,7 @@ sb_accept4(scmp_filter_ctx ctx) #ifdef __NR_mmap2 static int -sb_mmap2(scmp_filter_ctx ctx) +sb_mmap2(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; @@ -208,19 +207,18 @@ sb_mmap2(scmp_filter_ctx ctx) // TODO parameters static int -sb_open(scmp_filter_ctx ctx) +sb_open(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc; - sandbox_cfg_t *elem; + sandbox_cfg_t *elem = NULL; // for each dynamic parameter filters - elem = filter_dynamic; - for (; elem != NULL; elem = elem->next) { + for (elem = filter; elem != NULL; elem = elem->next) { if (elem->prot == 1 && elem->syscall == SCMP_SYS(open)) { rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(open), 1, SCMP_CMP(0, SCMP_CMP_EQ, elem->param)); if (rc != 0) { - log_err(LD_BUG,"(Sandbox) failed to add syscall, received libseccomp " + log_err(LD_BUG,"(Sandbox) failed to add open syscall, received libseccomp " "error %d", rc); return rc; } @@ -232,19 +230,18 @@ sb_open(scmp_filter_ctx ctx) // TODO parameters static int -sb_openat(scmp_filter_ctx ctx) +sb_openat(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc; - sandbox_cfg_t *elem; + sandbox_cfg_t *elem = NULL; // for each dynamic parameter filters - elem = filter_dynamic; - for (; elem != NULL; elem = elem->next) { + for (elem = filter; elem != NULL; elem = elem->next) { if (elem->prot == 1 && elem->syscall == SCMP_SYS(openat)) { rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(openat), 1, SCMP_CMP(1, SCMP_CMP_EQ, elem->param)); if (rc != 0) { - log_err(LD_BUG,"(Sandbox) failed to add syscall, received libseccomp " + log_err(LD_BUG,"(Sandbox) failed to add openat syscall, received libseccomp " "error %d", rc); return rc; } @@ -255,7 +252,7 @@ sb_openat(scmp_filter_ctx ctx) } static int -sb_clock_gettime(scmp_filter_ctx ctx) +sb_clock_gettime(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { return seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(clock_gettime), 1, SCMP_CMP(0, SCMP_CMP_EQ, CLOCK_MONOTONIC)); @@ -263,7 +260,7 @@ sb_clock_gettime(scmp_filter_ctx ctx) // TODO: param not working static int -sb_socket(scmp_filter_ctx ctx) +sb_socket(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; @@ -288,7 +285,7 @@ sb_socket(scmp_filter_ctx ctx) // TODO: param not working static int -sb_setsockopt(scmp_filter_ctx ctx) +sb_setsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; @@ -303,7 +300,7 @@ sb_setsockopt(scmp_filter_ctx ctx) #ifdef __NR_fcntl64 static int -sb_fcntl64(scmp_filter_ctx ctx) +sb_fcntl64(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; @@ -324,7 +321,7 @@ sb_fcntl64(scmp_filter_ctx ctx) // allows everything but will keep for now.. static int -sb_epoll_ctl(scmp_filter_ctx ctx) +sb_epoll_ctl(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; @@ -351,7 +348,7 @@ sb_epoll_ctl(scmp_filter_ctx ctx) * this list. */ static int -sb_prctl(scmp_filter_ctx ctx) +sb_prctl(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; @@ -367,7 +364,7 @@ sb_prctl(scmp_filter_ctx ctx) * does not NEED tobe here.. only occurs before filter */ static int -sb_mprotect(scmp_filter_ctx ctx) +sb_mprotect(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; @@ -383,7 +380,7 @@ sb_mprotect(scmp_filter_ctx ctx) * does not NEED tobe here.. only occurs before filter */ static int -sb_rt_sigprocmask(scmp_filter_ctx ctx) +sb_rt_sigprocmask(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; @@ -399,7 +396,7 @@ sb_rt_sigprocmask(scmp_filter_ctx ctx) * does not NEED tobe here.. only occurs before filter */ static int -sb_flock(scmp_filter_ctx ctx) +sb_flock(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; @@ -415,7 +412,7 @@ sb_flock(scmp_filter_ctx ctx) * does not NEED tobe here.. only occurs before filter */ static int -sb_futex(scmp_filter_ctx ctx) +sb_futex(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; @@ -432,12 +429,12 @@ sb_futex(scmp_filter_ctx ctx) * does not NEED tobe here.. only occurs before filter */ static int -sb_mremap(scmp_filter_ctx ctx) +sb_mremap(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mremap), 1, - SCMP_CMP(1, SCMP_CMP_EQ, MREMAP_MAYMOVE)); + SCMP_CMP(3, SCMP_CMP_EQ, MREMAP_MAYMOVE)); if (rc) return rc; @@ -445,7 +442,7 @@ sb_mremap(scmp_filter_ctx ctx) } static int -sb_poll(scmp_filter_ctx ctx) +sb_poll(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; @@ -543,8 +540,9 @@ sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file) elem->ptype = PARAM_PTR; elem->param = (intptr_t) prot_strdup((char*) file); elem->prot = 1; - elem->next = filter_dynamic; - filter_dynamic = elem; + + elem->next = *cfg; + *cfg = elem; return 0; } @@ -560,8 +558,9 @@ sandbox_cfg_allow_openat_filename(sandbox_cfg_t **cfg, char *file) elem->ptype = PARAM_PTR; elem->param = (intptr_t) prot_strdup((char*) file);; elem->prot = 1; - elem->next = filter_dynamic; - filter_dynamic = elem; + + elem->next = *cfg; + *cfg = elem; return 0; } @@ -577,8 +576,9 @@ sandbox_cfg_allow_execve(sandbox_cfg_t **cfg, char *com) elem->ptype = PARAM_PTR; elem->param = (intptr_t) prot_strdup((char*) com);; elem->prot = 1; - elem->next = filter_dynamic; - filter_dynamic = elem; + + elem->next = *cfg; + *cfg = elem; return 0; } @@ -590,9 +590,9 @@ add_param_filter(scmp_filter_ctx ctx, sandbox_cfg_t* cfg) // function pointer for (i = 0; i < ARRAY_LENGTH(filter_func); i++) { - if ((filter_func[i])(ctx)) { - log_err(LD_BUG,"(Sandbox) failed to add syscall, received libseccomp " - "error %d", rc); + if ((filter_func[i])(ctx, cfg)) { + log_err(LD_BUG,"(Sandbox) failed to add syscall %d, received libseccomp " + "error %d", i, rc); return rc; } } @@ -745,6 +745,22 @@ install_sigsys_debugging(void) return 0; } + +static int register_cfg(sandbox_cfg_t* cfg) { + sandbox_cfg_t *elem = NULL; + + if (filter_dynamic == NULL) { + filter_dynamic = cfg; + return 0; + } + + for (elem = filter_dynamic; elem->next != NULL; elem = elem->next); + + elem->next = cfg; + + return 0; +} + #endif // USE_LIBSECCOMP #ifdef USE_LIBSECCOMP @@ -761,6 +777,9 @@ initialise_libseccomp_sandbox(sandbox_cfg_t* cfg) if (install_syscall_filter(cfg)) return -2; + if (register_cfg(cfg)) + return -3; + return 0; } diff --git a/src/common/sandbox.h b/src/common/sandbox.h index 4344134..1d5c823 100644 --- a/src/common/sandbox.h +++ b/src/common/sandbox.h @@ -63,7 +63,8 @@ struct pfd_elem { }; typedef struct pfd_elem sandbox_cfg_t; -typedef int (*sandbox_filter_func_t)(scmp_filter_ctx ctx); +typedef int (*sandbox_filter_func_t)(scmp_filter_ctx ctx, + sandbox_cfg_t *filter); /** * Linux 32 bit definitions @@ -90,6 +91,7 @@ const char* sandbox_intern_string(const char *param); sandbox_cfg_t * sandbox_cfg_new(); int sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file); int sandbox_cfg_allow_openat_filename(sandbox_cfg_t **cfg, char *file); +int sandbox_cfg_allow_execve(sandbox_cfg_t **cfg, char *com); int sandbox_init(sandbox_cfg_t* cfg); #endif /* SANDBOX_H_ */ diff --git a/src/or/main.c b/src/or/main.c index ab3b840..3c98246 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -2651,6 +2651,8 @@ sandbox_init_filter() sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname("cached-certs")); sandbox_cfg_allow_open_filename(&cfg, + get_datadir_fname("cached-certs.tmp")); + sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname("cached-consensus")); sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname("unverified-consensus")); @@ -2681,6 +2683,8 @@ sandbox_init_filter() sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname("unparseable-desc")); + sandbox_cfg_allow_execve(&cfg, "/usr/local/bin/tor"); + return cfg; }

1 0

[tor/master] removed access, set_robust_list, set_thread_area, set_tid_address, uname; added sb_poll
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit dde3ed385bc9de8bffa52b9b5e525fb7a0aae88b Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Wed Jul 31 12:05:10 2013 +0300 removed access, set_robust_list, set_thread_area, set_tid_address, uname; added sb_poll --- src/common/sandbox.c | 31 ++++++++++++++++++++++++------- 1 file changed, 24 insertions(+), 7 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index fe2f457..d330cab 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -43,6 +43,7 @@ #include <unistd.h> #include <fcntl.h> #include <time.h> +#include <poll.h> sandbox_cfg_t *filter_dynamic = NULL; @@ -50,7 +51,6 @@ sandbox_cfg_t *filter_dynamic = NULL; * stage 1 general Tor sandbox. */ static int filter_nopar_gen[] = { - SCMP_SYS(access), SCMP_SYS(brk), SCMP_SYS(close), SCMP_SYS(clone), @@ -88,25 +88,27 @@ static int filter_nopar_gen[] = { SCMP_SYS(mlockall), SCMP_SYS(mmap), SCMP_SYS(munmap), - SCMP_SYS(poll), SCMP_SYS(read), SCMP_SYS(rename), SCMP_SYS(rt_sigreturn), #ifdef __NR_sigreturn SCMP_SYS(sigreturn), #endif - SCMP_SYS(set_robust_list), - SCMP_SYS(set_thread_area), - SCMP_SYS(set_tid_address), SCMP_SYS(stat), #ifdef __NR_stat64 SCMP_SYS(stat64), #endif - SCMP_SYS(uname), SCMP_SYS(write), SCMP_SYS(exit_group), SCMP_SYS(exit), + // Not needed.. +// SCMP_SYS(access), +// SCMP_SYS(set_robust_list), +// SCMP_SYS(set_thread_area), +// SCMP_SYS(set_tid_address), +// SCMP_SYS(uname), + // socket syscalls SCMP_SYS(bind), SCMP_SYS(connect), @@ -437,6 +439,20 @@ sb_mremap(scmp_filter_ctx ctx) return 0; } +static int +sb_poll(scmp_filter_ctx ctx) +{ + int rc = 0; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(poll), 2, + SCMP_CMP(1, SCMP_CMP_EQ, 1), + SCMP_CMP(2, SCMP_CMP_EQ, 10)); + if (rc) + return rc; + + return 0; +} + static sandbox_filter_func_t filter_func[] = { sb_rt_sigaction, sb_rt_sigprocmask, @@ -453,7 +469,8 @@ static sandbox_filter_func_t filter_func[] = { sb_mprotect, sb_flock, sb_futex, - sb_mremap + sb_mremap, + sb_poll }; const char*

1 0

[tor/master] fully switched to function pointers; problems with socketcall parameters
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit c1f5f1842e4f51234e9f5fe0ba6597d75cd72f6b Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Tue Jul 30 23:20:08 2013 +0300 fully switched to function pointers; problems with socketcall parameters --- src/common/sandbox.c | 80 +++++++++++++++++++++++++++++++++++--------------- 1 file changed, 56 insertions(+), 24 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 28f23e8..d13938d 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -39,6 +39,7 @@ #include <signal.h> #include <unistd.h> #include <fcntl.h> +#include <time.h> sandbox_cfg_t *filter_dynamic = NULL; @@ -48,7 +49,6 @@ sandbox_cfg_t *filter_dynamic = NULL; static int filter_nopar_gen[] = { SCMP_SYS(access), SCMP_SYS(brk), - SCMP_SYS(clock_gettime), SCMP_SYS(close), SCMP_SYS(clone), SCMP_SYS(epoll_create), @@ -117,7 +117,6 @@ static int filter_nopar_gen[] = { SCMP_SYS(exit), // socket syscalls -// SCMP_SYS(accept4), SCMP_SYS(bind), SCMP_SYS(connect), SCMP_SYS(getsockname), @@ -128,13 +127,14 @@ static int filter_nopar_gen[] = { SCMP_SYS(sendto), SCMP_SYS(send), SCMP_SYS(setsockopt), - SCMP_SYS(socket), SCMP_SYS(socketpair), SCMP_SYS(recvfrom), SCMP_SYS(unlink), }; -static int sb_rt_sigaction(scmp_filter_ctx ctx) { +static int +sb_rt_sigaction(scmp_filter_ctx ctx) +{ int i, rc; int param[] = { SIGINT, SIGTERM, SIGPIPE, SIGUSR1, SIGUSR2, SIGHUP, SIGCHLD, #ifdef SIGXFSZ @@ -152,7 +152,9 @@ static int sb_rt_sigaction(scmp_filter_ctx ctx) { return rc; } -static int sb_execve(scmp_filter_ctx ctx) { +static int +sb_execve(scmp_filter_ctx ctx) +{ int rc; sandbox_cfg_t *elem; @@ -173,18 +175,24 @@ static int sb_execve(scmp_filter_ctx ctx) { return 0; } -static int sb_time(scmp_filter_ctx ctx) { +static int +sb_time(scmp_filter_ctx ctx) +{ return seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(time), 1, SCMP_CMP(0, SCMP_CMP_EQ, 0)); } -static int sb_accept4(scmp_filter_ctx ctx) { +static int +sb_accept4(scmp_filter_ctx ctx) +{ return seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socketcall), 1, SCMP_CMP(0, SCMP_CMP_EQ, 18)); } #ifdef __NR_mmap2 -static int sb_mmap2(scmp_filter_ctx ctx) { +static int +sb_mmap2(scmp_filter_ctx ctx) +{ int rc = 0; rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mmap2), 2, @@ -206,7 +214,9 @@ static int sb_mmap2(scmp_filter_ctx ctx) { #endif // TODO parameters -static int sb_open(scmp_filter_ctx ctx) { +static int +sb_open(scmp_filter_ctx ctx) +{ int rc; sandbox_cfg_t *elem; @@ -228,7 +238,9 @@ static int sb_open(scmp_filter_ctx ctx) { } // TODO parameters -static int sb_openat(scmp_filter_ctx ctx) { +static int +sb_openat(scmp_filter_ctx ctx) +{ int rc; sandbox_cfg_t *elem; @@ -249,6 +261,38 @@ static int sb_openat(scmp_filter_ctx ctx) { return 0; } +static int +sb_clock_gettime(scmp_filter_ctx ctx) +{ + return seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(clock_gettime), 1, + SCMP_CMP(0, SCMP_CMP_EQ, CLOCK_MONOTONIC)); +} + +// TODO: param not working +static int +sb_socket(scmp_filter_ctx ctx) +{ + int rc = 0; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socketcall), 4, + SCMP_CMP(0, SCMP_CMP_EQ, 1), + SCMP_CMP(1, SCMP_CMP_EQ, PF_INET), + SCMP_CMP(2, SCMP_CMP_EQ, SOCK_STREAM|SOCK_CLOEXEC), + SCMP_CMP(3, SCMP_CMP_EQ, IPPROTO_TCP)); + if (rc) + return rc; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socketcall), 4, + SCMP_CMP(0, SCMP_CMP_EQ, 1), + SCMP_CMP(1, SCMP_CMP_EQ, PF_NETLINK), + SCMP_CMP(2, SCMP_CMP_EQ, SOCK_RAW), + SCMP_CMP(3, SCMP_CMP_EQ, 0)); + if (rc) + return rc; + + return 0; +} + static sandbox_filter_func_t filter_func[] = { sb_rt_sigaction, sb_execve, @@ -256,7 +300,8 @@ static sandbox_filter_func_t filter_func[] = { sb_accept4, sb_mmap2, sb_open, - sb_openat + sb_openat, + sb_clock_gettime, }; const char* @@ -351,7 +396,6 @@ static int add_param_filter(scmp_filter_ctx ctx, sandbox_cfg_t* cfg) { int i, rc = 0; - sandbox_cfg_t *elem; // function pointer for(i = 0; i < LENGHT(filter_func); i++) { @@ -362,18 +406,6 @@ add_param_filter(scmp_filter_ctx ctx, sandbox_cfg_t* cfg) } } -// // for each dynamic parameter filters -// elem = (cfg == NULL) ? filter_dynamic : cfg; -// for (; elem != NULL; elem = elem->next) { -// rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, elem->syscall, 1, -// SCMP_CMP(elem->pindex, SCMP_CMP_EQ, elem->param)); -// if (rc != 0) { -// log_err(LD_BUG,"(Sandbox) failed to add syscall, received libseccomp " -// "error %d", rc); -// return rc; -// } -// } - return 0; }

1 0

[tor/master] sigprocmask, epoll_ctl, prctl, mprotect, flock, futex, mremap
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit 313cbe6e24618c4c5875c8e3aab4cd563c97791f Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Wed Jul 31 11:35:25 2013 +0300 sigprocmask, epoll_ctl, prctl, mprotect, flock, futex, mremap --- src/common/sandbox.c | 115 ++++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 107 insertions(+), 8 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 6de95da..fe2f457 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -34,6 +34,8 @@ #include <sys/syscall.h> #include <sys/types.h> #include <sys/epoll.h> +#include <sys/prctl.h> +#include <linux/futex.h> #include <bits/signum.h> #include <seccomp.h> @@ -55,13 +57,10 @@ static int filter_nopar_gen[] = { SCMP_SYS(epoll_create), SCMP_SYS(epoll_wait), SCMP_SYS(fcntl), - - SCMP_SYS(flock), SCMP_SYS(fstat), #ifdef __NR_fstat64 SCMP_SYS(fstat64), #endif - SCMP_SYS(futex), SCMP_SYS(getdents64), SCMP_SYS(getegid), #ifdef __NR_getegid32 @@ -88,14 +87,10 @@ static int filter_nopar_gen[] = { SCMP_SYS(mkdir), SCMP_SYS(mlockall), SCMP_SYS(mmap), - SCMP_SYS(mprotect), - SCMP_SYS(mremap), SCMP_SYS(munmap), SCMP_SYS(poll), - SCMP_SYS(prctl), SCMP_SYS(read), SCMP_SYS(rename), - SCMP_SYS(rt_sigprocmask), SCMP_SYS(rt_sigreturn), #ifdef __NR_sigreturn SCMP_SYS(sigreturn), @@ -344,8 +339,107 @@ sb_epoll_ctl(scmp_filter_ctx ctx) return 0; } +/** + * If multiple filters need to be added, seccomp needs to be whitelisted in + * this list. + */ +static int +sb_prctl(scmp_filter_ctx ctx) +{ + int rc = 0; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(prctl), 1, + SCMP_CMP(0, SCMP_CMP_EQ, PR_SET_DUMPABLE)); + if (rc) + return rc; + + return 0; +} + +/** + * does not NEED tobe here.. only occurs before filter + */ +static int +sb_mprotect(scmp_filter_ctx ctx) +{ + int rc = 0; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mprotect), 1, + SCMP_CMP(2, SCMP_CMP_EQ, PROT_READ)); + if (rc) + return rc; + + return 0; +} + +/** + * does not NEED tobe here.. only occurs before filter + */ +static int +sb_rt_sigprocmask(scmp_filter_ctx ctx) +{ + int rc = 0; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(rt_sigprocmask), 1, + SCMP_CMP(0, SCMP_CMP_EQ, SIG_UNBLOCK)); + if (rc) + return rc; + + return 0; +} + +/** + * does not NEED tobe here.. only occurs before filter + */ +static int +sb_flock(scmp_filter_ctx ctx) +{ + int rc = 0; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(flock), 1, + SCMP_CMP(1, SCMP_CMP_EQ, LOCK_EX|LOCK_NB)); + if (rc) + return rc; + + return 0; +} + +/** + * does not NEED tobe here.. only occurs before filter + */ +static int +sb_futex(scmp_filter_ctx ctx) +{ + int rc = 0; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(futex), 1, + SCMP_CMP(1, SCMP_CMP_EQ, + FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME)); + if (rc) + return rc; + + return 0; +} + +/** + * does not NEED tobe here.. only occurs before filter + */ +static int +sb_mremap(scmp_filter_ctx ctx) +{ + int rc = 0; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mremap), 1, + SCMP_CMP(1, SCMP_CMP_EQ, MREMAP_MAYMOVE)); + if (rc) + return rc; + + return 0; +} + static sandbox_filter_func_t filter_func[] = { sb_rt_sigaction, + sb_rt_sigprocmask, sb_execve, sb_time, sb_accept4, @@ -354,7 +448,12 @@ static sandbox_filter_func_t filter_func[] = { sb_openat, sb_clock_gettime, sb_fcntl64, - sb_epoll_ctl + sb_epoll_ctl, + sb_prctl, + sb_mprotect, + sb_flock, + sb_futex, + sb_mremap }; const char*

1 0

[tor/master] updated filters to work with orport
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit 89b39db003922f5b05f9e4e2fc7658b225a2f70a Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Fri Aug 9 19:07:20 2013 +0300 updated filters to work with orport --- src/common/crypto.c | 3 ++- src/common/sandbox.c | 16 +++++++++++++++- src/or/cpuworker.c | 2 -- src/or/main.c | 19 ++++++++++++++++++- 4 files changed, 35 insertions(+), 5 deletions(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index e60172b..71d5166 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -56,6 +56,7 @@ #include "../common/util.h" #include "container.h" #include "compat.h" +#include "sandbox.h" #if OPENSSL_VERSION_NUMBER < OPENSSL_V_SERIES(0,9,8) #error "We require OpenSSL >= 0.9.8" @@ -2349,7 +2350,7 @@ crypto_strongest_rand(uint8_t *out, size_t out_len) return 0; #else for (i = 0; filenames[i]; ++i) { - fd = open(filenames[i], O_RDONLY, 0); + fd = open(sandbox_intern_string(filenames[i]), O_RDONLY, 0); if (fd<0) continue; log_info(LD_CRYPTO, "Reading entropy from \"%s\"", filenames[i]); n = read_all(fd, (char*)out, out_len, 0); diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 1f15674..2ba1432 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -104,6 +104,8 @@ static int filter_nopar_gen[] = { SCMP_SYS(exit_group), SCMP_SYS(exit), + SCMP_SYS(madvise), + // Not needed.. // SCMP_SYS(set_thread_area), // SCMP_SYS(set_tid_address), @@ -195,6 +197,13 @@ sb_mmap2(scmp_filter_ctx ctx, sandbox_cfg_t *filter) } rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mmap2), 2, + SCMP_CMP(2, SCMP_CMP_EQ, PROT_NONE), + SCMP_CMP(3, SCMP_CMP_EQ, MAP_PRIVATE|MAP_ANONYMOUS|MAP_NORESERVE)); + if (rc) { + return rc; + } + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mmap2), 2, SCMP_CMP(2, SCMP_CMP_EQ, PROT_READ|PROT_WRITE), SCMP_CMP(3, SCMP_CMP_EQ, MAP_PRIVATE|MAP_ANONYMOUS)); if (rc) { @@ -431,6 +440,11 @@ sb_mprotect(scmp_filter_ctx ctx, sandbox_cfg_t *filter) return rc; rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mprotect), 1, + SCMP_CMP(2, SCMP_CMP_EQ, PROT_READ|PROT_WRITE)); + if (rc) + return rc; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mprotect), 1, SCMP_CMP(2, SCMP_CMP_EQ, PROT_NONE)); if (rc) return rc; @@ -675,7 +689,7 @@ add_param_filter(scmp_filter_ctx ctx, sandbox_cfg_t* cfg) static int add_noparam_filter(scmp_filter_ctx ctx) { - int i, filter_size, rc = 0; + int i, rc = 0; // add general filters for (i = 0; i < ARRAY_LENGTH(filter_nopar_gen); i++) { diff --git a/src/or/cpuworker.c b/src/or/cpuworker.c index 245f67e..61f9faa 100644 --- a/src/or/cpuworker.c +++ b/src/or/cpuworker.c @@ -571,8 +571,6 @@ spawn_enough_cpuworkers(void) if (num_cpuworkers_needed > MAX_CPUWORKERS) num_cpuworkers_needed = MAX_CPUWORKERS; - getchar(); - while (num_cpuworkers < num_cpuworkers_needed) { if (spawn_cpuworker() < 0) { log_warn(LD_GENERAL,"Cpuworker spawn failed. Will try again later."); diff --git a/src/or/main.c b/src/or/main.c index 5b6b778..36acde4 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -2665,9 +2665,16 @@ sandbox_init_filter() get_datadir_fname("cached-microdescs.new.tmp")); sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname("unverified-microdesc-consensus")); - sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname("cached-descriptors")); + sandbox_cfg_allow_open_filename(&cfg, + get_datadir_fname("cached-descriptors")); sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname("cached-descriptors.new")); + sandbox_cfg_allow_open_filename(&cfg, + get_datadir_fname("cached-descriptors.tmp")); + sandbox_cfg_allow_open_filename(&cfg, + get_datadir_fname("cached-descriptors.new.tmp")); + sandbox_cfg_allow_open_filename(&cfg, + get_datadir_fname("cached-descriptors.tmp.tmp")); sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname("cached-extrainfo")); sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname("state.tmp")); sandbox_cfg_allow_open_filename(&cfg, @@ -2683,6 +2690,8 @@ sandbox_init_filter() sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname2("keys", "secret_onion_key_ntor")); sandbox_cfg_allow_open_filename(&cfg, + get_datadir_fname2("keys", "secret_onion_key_ntor.tmp")); + sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname2("keys", "secret_id_key.old")); sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname2("keys", "secret_onion_key.old")); @@ -2692,8 +2701,16 @@ sandbox_init_filter() get_datadir_fname2("keys", "secret_onion_key.tmp")); sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname("fingerprint")); + sandbox_cfg_allow_open_filename(&cfg, + get_datadir_fname("cached-consensus.tmp")); + sandbox_cfg_allow_open_filename(&cfg, + get_datadir_fname("cached-consensus")); sandbox_cfg_allow_open_filename(&cfg, "/etc/resolv.conf"); + sandbox_cfg_allow_open_filename(&cfg, "/dev/srandom"); + sandbox_cfg_allow_open_filename(&cfg, "/dev/urandom"); + sandbox_cfg_allow_open_filename(&cfg, "/dev/random"); + } sandbox_cfg_allow_execve(&cfg, "/usr/local/bin/tor");

1 0

[tor/master] fixes suggested by nickm
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit d897690fc7f6f6b5b3d37da2e3e2b05f38222f06 Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Mon Aug 5 14:17:46 2013 +0300 fixes suggested by nickm --- src/common/sandbox.c | 32 +++++++++++++++++++++++++++----- src/common/util.h | 2 ++ src/or/main.c | 1 + 3 files changed, 30 insertions(+), 5 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index d330cab..e35f51f 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -17,8 +17,7 @@ #include "torlog.h" #include "orconfig.h" #include "torint.h" - -#define LENGHT(x) (sizeof(x)) / sizeof(x[0]) +#include "util.h" #if defined(HAVE_SECCOMP_H) && defined(__linux__) #define USE_LIBSECCOMP @@ -45,7 +44,7 @@ #include <time.h> #include <poll.h> -sandbox_cfg_t *filter_dynamic = NULL; +static sandbox_cfg_t *filter_dynamic = NULL; /** Variable used for storing all syscall numbers that will be allowed with the * stage 1 general Tor sandbox. @@ -136,7 +135,7 @@ sb_rt_sigaction(scmp_filter_ctx ctx) #endif }; - for (i = 0; i < LENGHT(param); i++) { + for (i = 0; i < ARRAY_LENGTH(param); i++) { rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(rt_sigaction), 1, SCMP_CMP(0, SCMP_CMP_EQ, param[i])); if (rc) @@ -323,6 +322,7 @@ sb_fcntl64(scmp_filter_ctx ctx) } #endif +// allows everything but will keep for now.. static int sb_epoll_ctl(scmp_filter_ctx ctx) { @@ -338,6 +338,11 @@ sb_epoll_ctl(scmp_filter_ctx ctx) if (rc) return rc; + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(epoll_ctl), 1, + SCMP_CMP(1, SCMP_CMP_EQ, EPOLL_CTL_DEL)); + if (rc) + return rc; + return 0; } @@ -561,13 +566,30 @@ sandbox_cfg_allow_openat_filename(sandbox_cfg_t **cfg, char *file) return 0; } +int +sandbox_cfg_allow_execve(sandbox_cfg_t **cfg, char *com) +{ + sandbox_cfg_t *elem = NULL; + + elem = (sandbox_cfg_t*) malloc(sizeof(sandbox_cfg_t)); + elem->syscall = SCMP_SYS(openat); + elem->pindex = 1; + elem->ptype = PARAM_PTR; + elem->param = (intptr_t) prot_strdup((char*) com);; + elem->prot = 1; + elem->next = filter_dynamic; + filter_dynamic = elem; + + return 0; +} + static int add_param_filter(scmp_filter_ctx ctx, sandbox_cfg_t* cfg) { int i, rc = 0; // function pointer - for (i = 0; i < LENGHT(filter_func); i++) { + for (i = 0; i < ARRAY_LENGTH(filter_func); i++) { if ((filter_func[i])(ctx)) { log_err(LD_BUG,"(Sandbox) failed to add syscall, received libseccomp " "error %d", rc); diff --git a/src/common/util.h b/src/common/util.h index 5596378..fc4ca29 100644 --- a/src/common/util.h +++ b/src/common/util.h @@ -533,5 +533,7 @@ int format_helper_exit_status(unsigned char child_state, const char *libor_get_digests(void); +#define ARRAY_LENGTH(x) (sizeof(x)) / sizeof(x[0]) + #endif diff --git a/src/or/main.c b/src/or/main.c index ab7b6ec..ab3b840 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -2644,6 +2644,7 @@ sandbox_init_filter() { sandbox_cfg_t *cfg = sandbox_cfg_new(); + // TODO: mem leak sandbox_cfg_allow_openat_filename(&cfg, get_datadir_fname("cached-status"));

1 0

[tor/master] multi-configuration support using sandbox_t struct
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit a960e56c6818a2b1ae0173a0c6439a0c0f68d969 Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Mon Aug 5 16:01:31 2013 +0300 multi-configuration support using sandbox_t struct --- src/common/sandbox.h | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/common/sandbox.h b/src/common/sandbox.h index 1d5c823..2b26544 100644 --- a/src/common/sandbox.h +++ b/src/common/sandbox.h @@ -66,6 +66,15 @@ typedef struct pfd_elem sandbox_cfg_t; typedef int (*sandbox_filter_func_t)(scmp_filter_ctx ctx, sandbox_cfg_t *filter); + +typedef struct { + // function pointers associated with filter + sandbox_filter_func_t *filter_func; + + // filter function pointer parameters + sandbox_cfg_t *filter_dynamic; +} sandbox_t; + /** * Linux 32 bit definitions */

1 0

[tor/master] updated filters
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit c09b11b6d8595ef9d39f39d2060497e67cf3e756 Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Fri Aug 16 01:43:09 2013 +0300 updated filters --- src/common/sandbox.c | 84 ++++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 74 insertions(+), 10 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 6f95f64..c5e1231 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -119,15 +119,12 @@ static int filter_nopar_gen[] = { SCMP_SYS(bind), SCMP_SYS(connect), SCMP_SYS(getsockname), - SCMP_SYS(getsockopt), - SCMP_SYS(listen), SCMP_SYS(recv), SCMP_SYS(recvmsg), + SCMP_SYS(recvfrom), SCMP_SYS(sendto), SCMP_SYS(send), - SCMP_SYS(socketpair), - SCMP_SYS(recvfrom), - SCMP_SYS(unlink), + SCMP_SYS(unlink) // ? }; static int @@ -285,7 +282,6 @@ sb_open(scmp_filter_ctx ctx, sandbox_cfg_t *filter) return 0; } -// TODO parameters static int sb_openat(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { @@ -296,7 +292,10 @@ sb_openat(scmp_filter_ctx ctx, sandbox_cfg_t *filter) for (elem = filter; elem != NULL; elem = elem->next) { if (elem->prot == 1 && elem->syscall == SCMP_SYS(openat)) { rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(openat), 1, - SCMP_CMP(1, SCMP_CMP_EQ, elem->param)); + SCMP_CMP(0, SCMP_CMP_EQ, AT_FDCWD), + SCMP_CMP(1, SCMP_CMP_EQ, elem->param), + SCMP_CMP(2, SCMP_CMP_EQ, O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY| + O_CLOEXEC)); if (rc != 0) { log_err(LD_BUG,"(Sandbox) failed to add openat syscall, received libseccomp " "error %d", rc); @@ -308,12 +307,24 @@ sb_openat(scmp_filter_ctx ctx, sandbox_cfg_t *filter) return 0; } -// TODO: add correct param static int sb_socket(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; +#ifdef __i386__ + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), 0); + if (rc) + return rc; +#endif + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), 3, + SCMP_CMP(0, SCMP_CMP_EQ, PF_FILE), + SCMP_CMP(1, SCMP_CMP_EQ, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK), + SCMP_CMP(2, SCMP_CMP_EQ, IPPROTO_IP)); + if (rc) + return rc; + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), 3, SCMP_CMP(0, SCMP_CMP_EQ, PF_INET), SCMP_CMP(1, SCMP_CMP_EQ, SOCK_STREAM|SOCK_CLOEXEC), @@ -322,6 +333,13 @@ sb_socket(scmp_filter_ctx ctx, sandbox_cfg_t *filter) return rc; rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), 3, + SCMP_CMP(0, SCMP_CMP_EQ, PF_INET), + SCMP_CMP(1, SCMP_CMP_EQ, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK), + SCMP_CMP(2, SCMP_CMP_EQ, IPPROTO_IP)); + if (rc) + return rc; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), 3, SCMP_CMP(0, SCMP_CMP_EQ, PF_NETLINK), SCMP_CMP(1, SCMP_CMP_EQ, SOCK_RAW), SCMP_CMP(2, SCMP_CMP_EQ, 0)); @@ -331,12 +349,37 @@ sb_socket(scmp_filter_ctx ctx, sandbox_cfg_t *filter) return 0; } -// TODO: add correct param +static int +sb_socketpair(scmp_filter_ctx ctx, sandbox_cfg_t *filter) +{ + int rc = 0; + +#ifdef __i386__ + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socketpair), 0); + if (rc) + return rc; +#endif + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socketpair), 2, + SCMP_CMP(0, SCMP_CMP_EQ, PF_FILE), + SCMP_CMP(1, SCMP_CMP_EQ, SOCK_STREAM|SOCK_CLOEXEC)); + if (rc) + return rc; + + return 0; +} + static int sb_setsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; +#ifdef __i386__ + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt), 0); + if (rc) + return rc; +#endif + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt), 2, SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET), SCMP_CMP(2, SCMP_CMP_EQ, SO_REUSEADDR)); @@ -346,6 +389,25 @@ sb_setsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter) return 0; } +static int sb_getsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter) +{ + int rc = 0; + +#ifdef __i386__ + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt), 0); + if (rc) + return rc; +#endif + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt), 2, + SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET), + SCMP_CMP(2, SCMP_CMP_EQ, SO_ERROR)); + if (rc) + return rc; + + return 0; +} + #ifdef __NR_fcntl64 static int sb_fcntl64(scmp_filter_ctx ctx, sandbox_cfg_t *filter) @@ -579,7 +641,9 @@ static sandbox_filter_func_t filter_func[] = { sb_stat64, sb_socket, - sb_setsockopt + sb_setsockopt, + sb_getsockopt, + sb_socketpair }; const char*

1 0

[tor/master] received feedback and fixed (partly) the socket filters
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit 863dd4d4b30f03313189ba40509ae114adbd7f60 Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Thu Aug 15 00:23:51 2013 +0300 received feedback and fixed (partly) the socket filters --- src/common/sandbox.c | 29 ++++++++++++++--------------- 1 file changed, 14 insertions(+), 15 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index f4c0779..6f95f64 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -125,8 +125,6 @@ static int filter_nopar_gen[] = { SCMP_SYS(recvmsg), SCMP_SYS(sendto), SCMP_SYS(send), - SCMP_SYS(setsockopt), - SCMP_SYS(socket), SCMP_SYS(socketpair), SCMP_SYS(recvfrom), SCMP_SYS(unlink), @@ -310,32 +308,30 @@ sb_openat(scmp_filter_ctx ctx, sandbox_cfg_t *filter) return 0; } -// TODO: param not working +// TODO: add correct param static int sb_socket(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; - rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socketcall), 4, - SCMP_CMP(0, SCMP_CMP_EQ, 1), - SCMP_CMP(1, SCMP_CMP_EQ, PF_INET), - SCMP_CMP(2, SCMP_CMP_EQ, SOCK_STREAM|SOCK_CLOEXEC), - SCMP_CMP(3, SCMP_CMP_EQ, IPPROTO_TCP)); + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), 3, + SCMP_CMP(0, SCMP_CMP_EQ, PF_INET), + SCMP_CMP(1, SCMP_CMP_EQ, SOCK_STREAM|SOCK_CLOEXEC), + SCMP_CMP(2, SCMP_CMP_EQ, IPPROTO_TCP)); if (rc) return rc; - rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socketcall), 4, - SCMP_CMP(0, SCMP_CMP_EQ, 1), - SCMP_CMP(1, SCMP_CMP_EQ, PF_NETLINK), - SCMP_CMP(2, SCMP_CMP_EQ, SOCK_RAW), - SCMP_CMP(3, SCMP_CMP_EQ, 0)); + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), 3, + SCMP_CMP(0, SCMP_CMP_EQ, PF_NETLINK), + SCMP_CMP(1, SCMP_CMP_EQ, SOCK_RAW), + SCMP_CMP(2, SCMP_CMP_EQ, 0)); if (rc) return rc; return 0; } -// TODO: param not working +// TODO: add correct param static int sb_setsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { @@ -580,7 +576,10 @@ static sandbox_filter_func_t filter_func[] = { sb_futex, sb_mremap, sb_poll, - sb_stat64 + sb_stat64, + + sb_socket, + sb_setsockopt }; const char*

1 0

[tor/master] attempt to add stat64 filename filters; failed due to getaddrinfo..
by nickm＠torproject.org 13 Sep '13

13 Sep '13

commit 8a85a48b9d0ed2b298bcc26dfeb96fa7e31c05c4 Author: Cristian Toader <cristian.matei.toader(a)gmail.com> Date: Mon Aug 12 21:14:43 2013 +0300 attempt to add stat64 filename filters; failed due to getaddrinfo.. --- src/common/sandbox.c | 80 ++++++++++++++++++++++++++++++++++++++++++++++---- src/common/sandbox.h | 7 +++++ src/common/util.c | 4 +-- src/or/config.c | 2 +- src/or/dns.c | 3 +- src/or/main.c | 13 ++++++++ 6 files changed, 100 insertions(+), 9 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index f2ead21..0be4c52 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -97,16 +97,14 @@ static int filter_nopar_gen[] = { SCMP_SYS(sigreturn), #endif SCMP_SYS(stat), -#ifdef __NR_stat64 - SCMP_SYS(stat64), // TODO -#endif SCMP_SYS(uname), SCMP_SYS(write), SCMP_SYS(exit_group), SCMP_SYS(exit), SCMP_SYS(madvise), - + // getaddrinfo uses this.. + SCMP_SYS(stat64), // Not needed.. // SCMP_SYS(set_thread_area), // SCMP_SYS(set_tid_address), @@ -542,6 +540,31 @@ sb_poll(scmp_filter_ctx ctx, sandbox_cfg_t *filter) return 0; } +#ifdef __NR_stat64 +static int +sb_stat64(scmp_filter_ctx ctx, sandbox_cfg_t *filter) +{ + int rc = 0; + sandbox_cfg_t *elem = NULL; + + // for each dynamic parameter filters + for (elem = filter; elem != NULL; elem = elem->next) { + if (elem->prot == 1 && (elem->syscall == SCMP_SYS(open) || + elem->syscall == SCMP_SYS(stat64))) { + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(stat64), 1, + SCMP_CMP(0, SCMP_CMP_EQ, elem->param)); + if (rc != 0) { + log_err(LD_BUG,"(Sandbox) failed to add open syscall, received libseccomp " + "error %d", rc); + return rc; + } + } + } + + return 0; +} +#endif + static sandbox_filter_func_t filter_func[] = { sb_rt_sigaction, sb_rt_sigprocmask, @@ -559,7 +582,8 @@ static sandbox_filter_func_t filter_func[] = { sb_flock, sb_futex, sb_mremap, - sb_poll + sb_poll, + sb_stat64 }; const char* @@ -616,6 +640,52 @@ prot_strdup(char* str) return res; } +#ifdef __NR_stat64 +int +sandbox_cfg_allow_stat64_filename(sandbox_cfg_t **cfg, char *file, char fr) +{ + sandbox_cfg_t *elem = NULL; + + elem = (sandbox_cfg_t*) malloc(sizeof(sandbox_cfg_t)); + elem->syscall = SCMP_SYS(stat64); + elem->pindex = 0; + elem->ptype = PARAM_PTR; + elem->param = (intptr_t) prot_strdup((char*) file); + elem->prot = 1; + + elem->next = *cfg; + *cfg = elem; + + if (fr) tor_free_(file); + + return 0; +} + +int +sandbox_cfg_allow_stat64_filename_array(sandbox_cfg_t **cfg, int num, ...) +{ + int rc = 0, i; + + va_list ap; + va_start(ap, num); + + for (i = 0; i < num; i++) { + char *fn = va_arg(ap, char*); + char fr = (char) va_arg(ap, int); + + rc = sandbox_cfg_allow_stat64_filename(cfg, fn, fr); + if(rc) { + log_err(LD_BUG,"(Sandbox) failed on par %d", i); + goto end; + } + } + + end: + va_end(ap); + return 0; +} +#endif + int sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file, char fr) { diff --git a/src/common/sandbox.h b/src/common/sandbox.h index 33668d9..e928591 100644 --- a/src/common/sandbox.h +++ b/src/common/sandbox.h @@ -9,6 +9,8 @@ * \brief Header file for sandbox.c. **/ +// TODO: thinking of only having allow_file for multiple syscalls + #ifndef SANDBOX_H_ #define SANDBOX_H_ @@ -110,6 +112,11 @@ int sandbox_cfg_allow_openat_filename_array(sandbox_cfg_t **cfg, int num, ...); int sandbox_cfg_allow_execve(sandbox_cfg_t **cfg, char *com); int sandbox_cfg_allow_execve_array(sandbox_cfg_t **cfg, int num, ...); +int sandbox_cfg_allow_stat64_filename(sandbox_cfg_t **cfg, char *file, + char fr); +int sandbox_cfg_allow_stat64_filename_array(sandbox_cfg_t **cfg, + int num, ...); + int sandbox_init(sandbox_cfg_t* cfg); #endif /* SANDBOX_H_ */ diff --git a/src/common/util.c b/src/common/util.c index 75462b6..8408a36 100644 --- a/src/common/util.c +++ b/src/common/util.c @@ -1803,7 +1803,7 @@ file_status(const char *fname) int r; f = tor_strdup(fname); clean_name_for_stat(f); - r = stat(f, &st); + r = stat(sandbox_intern_string(f), &st); tor_free(f); if (r) { if (errno == ENOENT) { @@ -1853,7 +1853,7 @@ check_private_dir(const char *dirname, cpd_check_t check, tor_assert(dirname); f = tor_strdup(dirname); clean_name_for_stat(f); - r = stat(f, &st); + r = stat(sandbox_intern_string(f), &st); tor_free(f); if (r) { if (errno != ENOENT) { diff --git a/src/or/config.c b/src/or/config.c index e53c288..e1b7b4e 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -6121,7 +6121,7 @@ remove_file_if_very_old(const char *fname, time_t now) #define VERY_OLD_FILE_AGE (28*24*60*60) struct stat st; - if (stat(fname, &st)==0 && st.st_mtime < now-VERY_OLD_FILE_AGE) { + if (stat(sandbox_intern_string(fname), &st)==0 && st.st_mtime < now-VERY_OLD_FILE_AGE) { char buf[ISO_TIME_LEN+1]; format_local_iso_time(buf, st.st_mtime); log_notice(LD_GENERAL, "Obsolete file %s hasn't been modified since %s. " diff --git a/src/or/dns.c b/src/or/dns.c index edcf92e..6dc0c05 100644 --- a/src/or/dns.c +++ b/src/or/dns.c @@ -24,6 +24,7 @@ #include "relay.h" #include "router.h" #include "ht.h" +#include "../common/sandbox.h" #ifdef HAVE_EVENT2_DNS_H #include <event2/event.h> #include <event2/dns.h> @@ -1477,7 +1478,7 @@ configure_nameservers(int force) evdns_set_log_fn(evdns_log_cb); if (conf_fname) { - if (stat(conf_fname, &st)) { + if (stat(sandbox_intern_string(conf_fname), &st)) { log_warn(LD_EXIT, "Unable to stat resolver configuration in '%s': %s", conf_fname, strerror(errno)); goto err; diff --git a/src/or/main.c b/src/or/main.c index c236e83..a2fbe5f 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -2672,6 +2672,14 @@ sandbox_init_filter() "/dev/urandom", 0 ); + sandbox_cfg_allow_stat64_filename_array(&cfg, 5, + get_datadir_fname(NULL), 1, + get_datadir_fname("lock"), 1, + get_datadir_fname("state"), 1, + get_datadir_fname("router-stability"), 1, + get_datadir_fname("cached-extrainfo.new"), 1 + ); + // orport if (server_mode(get_options())) { sandbox_cfg_allow_open_filename_array(&cfg, 13, @@ -2689,6 +2697,11 @@ sandbox_init_filter() "/etc/resolv.conf", 0, "/dev/random", 0 ); + + sandbox_cfg_allow_stat64_filename_array(&cfg, 2, + get_datadir_fname("keys"), 1, + get_datadir_fname("stats/dirreq-stats"), 1 + ); } sandbox_cfg_allow_execve(&cfg, "/usr/local/bin/tor");

1 0