April 2014 - tor-commits - lists.torproject.org

[tor/master] Make sure everything using an interned string is preceded by a log
by nickm＠torproject.org 17 Apr '14

17 Apr '14

commit 156eefca454e10440d1070f7500e1708589fc64b Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 16 13:17:09 2014 -0400 Make sure everything using an interned string is preceded by a log (It's nice to know what we were about to rename before we died from renaming it.) --- src/common/compat.c | 2 ++ src/common/crypto.c | 1 + src/common/util.c | 2 ++ src/or/config.c | 1 + src/or/dns.c | 2 ++ 5 files changed, 8 insertions(+) diff --git a/src/common/compat.c b/src/common/compat.c index 5c18535..c5945fb 100644 --- a/src/common/compat.c +++ b/src/common/compat.c @@ -144,6 +144,7 @@ tor_open_cloexec(const char *path, int flags, unsigned mode) return -1; #endif + log_debug(LD_FS, "Opening %s with flags %x", path, flags); fd = open(path, flags, mode); #ifdef FD_CLOEXEC if (fd >= 0) { @@ -179,6 +180,7 @@ tor_fopen_cloexec(const char *path, const char *mode) int tor_rename(const char *path_old, const char *path_new) { + log_debug(LD_FS, "Renaming %s to %s", path_old, path_new); return rename(sandbox_intern_string(path_old), sandbox_intern_string(path_new)); } diff --git a/src/common/crypto.c b/src/common/crypto.c index 8a4ffb6..a247a87 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -2471,6 +2471,7 @@ crypto_strongest_rand(uint8_t *out, size_t out_len) return 0; #else for (i = 0; filenames[i]; ++i) { + log_debug(LD_FS, "Opening %s for entropy", filenames[i]); fd = open(sandbox_intern_string(filenames[i]), O_RDONLY, 0); if (fd<0) continue; log_info(LD_CRYPTO, "Reading entropy from \"%s\"", filenames[i]); diff --git a/src/common/util.c b/src/common/util.c index a50f256..86bb8ba 100644 --- a/src/common/util.c +++ b/src/common/util.c @@ -1830,6 +1830,7 @@ file_status(const char *fname) int r; f = tor_strdup(fname); clean_name_for_stat(f); + log_debug(LD_FS, "stat()ing %s", f); r = stat(sandbox_intern_string(f), &st); tor_free(f); if (r) { @@ -1880,6 +1881,7 @@ check_private_dir(const char *dirname, cpd_check_t check, tor_assert(dirname); f = tor_strdup(dirname); clean_name_for_stat(f); + log_debug(LD_FS, "stat()ing %s", f); r = stat(sandbox_intern_string(f), &st); tor_free(f); if (r) { diff --git a/src/or/config.c b/src/or/config.c index 89aedcc..c2eebf7 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -6462,6 +6462,7 @@ remove_file_if_very_old(const char *fname, time_t now) #define VERY_OLD_FILE_AGE (28*24*60*60) struct stat st; + log_debug(LD_FS, "stat()ing %s", fname); if (stat(sandbox_intern_string(fname), &st)==0 && st.st_mtime < now-VERY_OLD_FILE_AGE) { char buf[ISO_TIME_LEN+1]; diff --git a/src/or/dns.c b/src/or/dns.c index 21c82e8..3627193 100644 --- a/src/or/dns.c +++ b/src/or/dns.c @@ -1480,6 +1480,7 @@ configure_nameservers(int force) evdns_set_log_fn(evdns_log_cb); if (conf_fname) { + log_debug(LD_FS, "stat()ing %s", conf_fname); if (stat(sandbox_intern_string(conf_fname), &st)) { log_warn(LD_EXIT, "Unable to stat resolver configuration in '%s': %s", conf_fname, strerror(errno)); @@ -1497,6 +1498,7 @@ configure_nameservers(int force) #if defined(DNS_OPTION_HOSTSFILE) && defined(USE_LIBSECCOMP) if (flags & DNS_OPTION_HOSTSFILE) { flags ^= DNS_OPTION_HOSTSFILE; + log_debug(LD_FS, "Loading /etc/hosts"); evdns_base_load_hosts(the_evdns_base, sandbox_intern_string("/etc/hosts")); }

1 0

[tor/master] Use SCMP_CMP_MASKED_EQ to allow flags, not force them
by nickm＠torproject.org 17 Apr '14

17 Apr '14

commit 69eb2788302aa96e7d37597c407e8f7da4e8a96f Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 16 15:17:23 2014 -0400 Use SCMP_CMP_MASKED_EQ to allow flags, not force them Older versions of Libevent are happy to open SOCK_DGRAM sockets non-cloexec and non-nonblocking, and then set those flags afterwards. It's nice to be able to allow a flag to be on or off in the sandbox without having to enumerate all its values. Also, permit PF_INET6 sockets. (D'oh!) --- src/common/sandbox.c | 51 +++++++++++++++++++++++++------------------------- 1 file changed, 25 insertions(+), 26 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 40f2003..5f9d625 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -77,6 +77,13 @@ static sb_addr_info_t *sb_addr_info = NULL; #undef SCMP_CMP #define SCMP_CMP(a,b,c) ((struct scmp_arg_cmp){(a),(b),(c),0}) +#define SCMP_CMP4(a,b,c,d) ((struct scmp_arg_cmp){(a),(b),(c),(d)}) +/* We use a wrapper here because these masked comparisons seem to be pretty + * verbose. Also, it's important to cast to scmp_datum_t before negating the + * mask, since otherwise the negation might get applied to a 32 bit value, and + * the high bits of the value might get masked out improperly. */ +#define SCMP_CMP_MASKED(a,b,c) \ + SCMP_CMP4((a), SCMP_CMP_MASKED_EQ, ~(scmp_datum_t)(b), (c)) /** Variable used for storing all syscall numbers that will be allowed with the * stage 1 general Tor sandbox. @@ -258,12 +265,7 @@ sb_accept4(scmp_filter_ctx ctx, sandbox_cfg_t *filter) #endif rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(accept4), - SCMP_CMP(3, SCMP_CMP_EQ, SOCK_CLOEXEC)); - if (rc) { - return rc; - } - rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(accept4), - SCMP_CMP(3, SCMP_CMP_EQ, SOCK_CLOEXEC|SOCK_NONBLOCK)); + SCMP_CMP_MASKED(3, SOCK_CLOEXEC|SOCK_NONBLOCK, 0)); if (rc) { return rc; } @@ -362,7 +364,7 @@ sb_open(scmp_filter_ctx ctx, sandbox_cfg_t *filter) } rc = seccomp_rule_add_1(ctx, SCMP_ACT_ERRNO(-1), SCMP_SYS(open), - SCMP_CMP(1, SCMP_CMP_EQ, O_RDONLY|O_CLOEXEC)); + SCMP_CMP_MASKED(1, O_CLOEXEC, O_RDONLY)); if (rc != 0) { log_err(LD_BUG,"(Sandbox) failed to add open syscall, received libseccomp " "error %d", rc); @@ -460,6 +462,7 @@ static int sb_socket(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; + int i; (void) filter; #ifdef __i386__ @@ -468,33 +471,29 @@ sb_socket(scmp_filter_ctx ctx, sandbox_cfg_t *filter) return rc; #endif - rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), + rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), SCMP_CMP(0, SCMP_CMP_EQ, PF_FILE), - SCMP_CMP(1, SCMP_CMP_EQ, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK), - SCMP_CMP(2, SCMP_CMP_EQ, IPPROTO_IP)); + SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, SOCK_STREAM)); if (rc) return rc; - rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), - SCMP_CMP(0, SCMP_CMP_EQ, PF_INET), - SCMP_CMP(1, SCMP_CMP_EQ, SOCK_STREAM|SOCK_CLOEXEC), - SCMP_CMP(2, SCMP_CMP_EQ, IPPROTO_TCP)); - if (rc) - return rc; + for (i = 0; i < 2; ++i) { + const int pf = i ? PF_INET : PF_INET6; - rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), - SCMP_CMP(0, SCMP_CMP_EQ, PF_INET), - SCMP_CMP(1, SCMP_CMP_EQ, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK), + rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), + SCMP_CMP(0, SCMP_CMP_EQ, pf), + SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, SOCK_STREAM), SCMP_CMP(2, SCMP_CMP_EQ, IPPROTO_TCP)); - if (rc) - return rc; + if (rc) + return rc; - rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), - SCMP_CMP(0, SCMP_CMP_EQ, PF_INET), - SCMP_CMP(1, SCMP_CMP_EQ, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK), + rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), + SCMP_CMP(0, SCMP_CMP_EQ, pf), + SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, SOCK_DGRAM), SCMP_CMP(2, SCMP_CMP_EQ, IPPROTO_IP)); - if (rc) - return rc; + if (rc) + return rc; + } rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), SCMP_CMP(0, SCMP_CMP_EQ, PF_NETLINK),

1 0

[tor/master] Get Libevent's PRNG functioning under the linux sandbox
by nickm＠torproject.org 17 Apr '14

17 Apr '14

commit e6785ee16dce675aa770616bcdbd128d5dfb1132 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 16 14:54:39 2014 -0400 Get Libevent's PRNG functioning under the linux sandbox Libevent uses an arc4random implementation (I know, I know) to generate DNS transaction IDs and capitalization. But it liked to initialize it either with opening /dev/urandom (which won't work under the sandbox if it doesn't use the right pointer), or with sysctl({CTL_KERN,KERN_RANDOM,RANDOM_UUIC}). To make _that_ work, we were permitting sysctl unconditionally. That's not such a great idea. Instead, we try to initialize the libevent PRNG _before_ installing the sandbox, and make sysctl always fail with EPERM under the sandbox. --- configure.ac | 1 + src/common/compat_libevent.c | 19 +++++++++++++++++++ src/common/compat_libevent.h | 2 ++ src/common/sandbox.c | 19 ++++++++++++++++++- src/or/main.c | 10 ++++++++++ 5 files changed, 50 insertions(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac index 6e41041..6e5331b 100644 --- a/configure.ac +++ b/configure.ac @@ -435,6 +435,7 @@ AC_CHECK_FUNCS([event_get_version \ event_set_log_callback \ evdns_set_outgoing_bind_address \ evutil_secure_rng_set_urandom_device_file \ + evutil_secure_rng_init \ event_base_loopexit]) AC_CHECK_MEMBERS([struct event.min_heap_idx], , , [#include <event.h> diff --git a/src/common/compat_libevent.c b/src/common/compat_libevent.c index 8525b4a..74b54bb 100644 --- a/src/common/compat_libevent.c +++ b/src/common/compat_libevent.c @@ -13,6 +13,8 @@ #include "compat.h" #include "compat_libevent.h" +#include "crypto.h" + #include "util.h" #include "torlog.h" @@ -626,6 +628,23 @@ tor_add_bufferevent_to_rate_limit_group(struct bufferevent *bev, } #endif +int +tor_init_libevent_rng(void) +{ + int rv = 0; +#ifdef HAVE_EVUTIL_SECURE_RNG_INIT + char buf[256]; + if (evutil_secure_rng_init() < 0) { + rv = -1; + } + /* Older libevent -- manually initialize the RNG */ + crypto_rand(buf, 32); + evutil_secure_rng_add_bytes(buf, 32); + evutil_secure_rng_get_bytes(buf, sizeof(buf)); +#endif + return rv; +} + #if defined(LIBEVENT_VERSION_NUMBER) && LIBEVENT_VERSION_NUMBER >= V(2,1,1) \ && !defined(TOR_UNIT_TESTS) void diff --git a/src/common/compat_libevent.h b/src/common/compat_libevent.h index f0d1828..9ee7b49 100644 --- a/src/common/compat_libevent.h +++ b/src/common/compat_libevent.h @@ -89,6 +89,8 @@ int tor_add_bufferevent_to_rate_limit_group(struct bufferevent *bev, struct bufferevent_rate_limit_group *g); #endif +int tor_init_libevent_rng(void); + void tor_gettimeofday_cached(struct timeval *tv); void tor_gettimeofday_cache_clear(void); #ifdef TOR_UNIT_TESTS diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 2a1ddd1..40f2003 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -124,7 +124,6 @@ static int filter_nopar_gen[] = { SCMP_SYS(read), SCMP_SYS(rt_sigreturn), SCMP_SYS(set_robust_list), - SCMP_SYS(_sysctl), #ifdef __NR_sigreturn SCMP_SYS(sigreturn), #endif @@ -373,6 +372,23 @@ sb_open(scmp_filter_ctx ctx, sandbox_cfg_t *filter) return 0; } +static int +sb__sysctl(scmp_filter_ctx ctx, sandbox_cfg_t *filter) +{ + int rc; + (void) filter; + (void) ctx; + + rc = seccomp_rule_add_0(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(_sysctl)); + if (rc != 0) { + log_err(LD_BUG,"(Sandbox) failed to add _sysctl syscall, " + "received libseccomp error %d", rc); + return rc; + } + + return 0; +} + /** * Function responsible for setting up the rename syscall for * the seccomp filter sandbox. @@ -850,6 +866,7 @@ static sandbox_filter_func_t filter_func[] = { #endif sb_open, sb_openat, + sb__sysctl, sb_rename, #ifdef __NR_fcntl64 sb_fcntl64, diff --git a/src/or/main.c b/src/or/main.c index 341f22a..c0f14c0 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -2432,6 +2432,9 @@ tor_init(int argc, char *argv[]) return -1; } stream_choice_seed_weak_rng(); + if (tor_init_libevent_rng() < 0) { + log_warn(LD_NET, "Problem initializing libevent RNG."); + } return 0; } @@ -2723,6 +2726,7 @@ init_addrinfo(void) static sandbox_cfg_t* sandbox_init_filter(void) { + const or_options_t *options = get_options(); sandbox_cfg_t *cfg = sandbox_cfg_new(); sandbox_cfg_allow_openat_filename(&cfg, @@ -2761,8 +2765,14 @@ sandbox_init_filter(void) tor_strdup("/dev/srandom"), tor_strdup("/dev/urandom"), tor_strdup("/dev/random"), + tor_strdup("/etc/hosts"), NULL, 0 ); + if (options->ServerDNSResolvConfFile) + sandbox_cfg_allow_open_filename(&cfg, + tor_strdup(options->ServerDNSResolvConfFile)); + else + sandbox_cfg_allow_open_filename(&cfg, tor_strdup("/etc/resolv.conf")); #define RENAME_SUFFIX(name, suffix) \ sandbox_cfg_allow_rename(&cfg, \

1 0

[tor/master] Add a couple of missing renames so the server sandbox works again
by nickm＠torproject.org 17 Apr '14

17 Apr '14

commit ce776cf2700e5bb484630bc287b31204162adfac Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 16 15:15:31 2014 -0400 Add a couple of missing renames so the server sandbox works again --- src/or/main.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/or/main.c b/src/or/main.c index c0f14c0..cdbb2db 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -2839,6 +2839,13 @@ sandbox_init_filter(void) RENAME_SUFFIX2("keys", "secret_onion_key.old", ".tmp"); RENAME_SUFFIX("hashed-fingerprint", ".tmp"); + sandbox_cfg_allow_rename(&cfg, + get_datadir_fname2("keys", "secret_onion_key"), + get_datadir_fname2("keys", "secret_onion_key.old")); + sandbox_cfg_allow_rename(&cfg, + get_datadir_fname2("keys", "secret_onion_key_ntor"), + get_datadir_fname2("keys", "secret_onion_key_ntor.old")); + sandbox_cfg_allow_stat_filename_array(&cfg, get_datadir_fname("keys"), get_datadir_fname("stats/dirreq-stats"),

1 0

[tor/master] Allow reloading torrc and writing to router-stability
by nickm＠torproject.org 17 Apr '14

17 Apr '14

commit 18f7f49a8c08a38c15de4b8e6413ed2ae0968639 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 16 15:54:45 2014 -0400 Allow reloading torrc and writing to router-stability --- src/or/main.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/or/main.c b/src/or/main.c index cdbb2db..4770b7e 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -2728,6 +2728,7 @@ sandbox_init_filter(void) { const or_options_t *options = get_options(); sandbox_cfg_t *cfg = sandbox_cfg_new(); + int i; sandbox_cfg_allow_openat_filename(&cfg, get_datadir_fname("cached-status")); @@ -2774,6 +2775,12 @@ sandbox_init_filter(void) else sandbox_cfg_allow_open_filename(&cfg, tor_strdup("/etc/resolv.conf")); + for (i = 0; i < 2; ++i) { + if (get_torrc_fname(i)) { + sandbox_cfg_allow_open_filename(&cfg, tor_strdup(get_torrc_fname(i))); + } + } + #define RENAME_SUFFIX(name, suffix) \ sandbox_cfg_allow_rename(&cfg, \ get_datadir_fname(name suffix), \ @@ -2827,6 +2834,8 @@ sandbox_init_filter(void) get_datadir_fname("fingerprint.tmp"), get_datadir_fname("hashed-fingerprint"), get_datadir_fname("hashed-fingerprint.tmp"), + get_datadir_fname("router-stability"), + get_datadir_fname("router-stability.tmp"), tor_strdup("/etc/resolv.conf"), NULL, 0 ); @@ -2838,6 +2847,7 @@ sandbox_init_filter(void) RENAME_SUFFIX2("keys", "secret_onion_key", ".tmp"); RENAME_SUFFIX2("keys", "secret_onion_key.old", ".tmp"); RENAME_SUFFIX("hashed-fingerprint", ".tmp"); + RENAME_SUFFIX("router-stability", ".tmp"); sandbox_cfg_allow_rename(&cfg, get_datadir_fname2("keys", "secret_onion_key"),

1 0

[tor/master] Don't allow change to ConnLimit while sandbox is active
by nickm＠torproject.org 17 Apr '14

17 Apr '14

commit 619497076585c54dc80656cdd4e6181f1109ff53 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 16 16:05:10 2014 -0400 Don't allow change to ConnLimit while sandbox is active --- src/common/sandbox.c | 11 +++++++++++ src/common/sandbox.h | 3 +++ src/or/config.c | 18 ++++++++++++------ 3 files changed, 26 insertions(+), 6 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 5f9d625..0722751 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -1576,6 +1576,11 @@ initialise_libseccomp_sandbox(sandbox_cfg_t* cfg) return 0; } +int +sandbox_is_active(void) +{ + return sandbox_active != 0; +} #endif // USE_LIBSECCOMP sandbox_cfg_t* @@ -1672,5 +1677,11 @@ sandbox_cfg_allow_rename(sandbox_cfg_t **cfg, char *file1, char *file2) (void)cfg; (void)file1; (void)file2; return 0; } + +int +sandbox_is_active(void) +{ + return 0; +} #endif diff --git a/src/common/sandbox.h b/src/common/sandbox.h index c4144db..c40f5e0 100644 --- a/src/common/sandbox.h +++ b/src/common/sandbox.h @@ -229,5 +229,8 @@ int sandbox_cfg_allow_stat_filename_array(sandbox_cfg_t **cfg, ...); /** Function used to initialise a sandbox configuration.*/ int sandbox_init(sandbox_cfg_t* cfg); +/** Return true iff the sandbox is turned on. */ +int sandbox_is_active(void); + #endif /* SANDBOX_H_ */ diff --git a/src/or/config.c b/src/or/config.c index c2eebf7..881da37 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -1,4 +1,4 @@ - /* Copyright (c) 2001 Matej Pfajfar. +/* Copyright (c) 2001 Matej Pfajfar. * Copyright (c) 2001-2004, Roger Dingledine. * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson. * Copyright (c) 2007-2013, The Tor Project, Inc. */ @@ -1043,12 +1043,18 @@ options_act_reversible(const or_options_t *old_options, char **msg) if (running_tor) { int n_ports=0; /* We need to set the connection limit before we can open the listeners. */ - if (set_max_file_descriptors((unsigned)options->ConnLimit, - &options->ConnLimit_) < 0) { - *msg = tor_strdup("Problem with ConnLimit value. See logs for details."); - goto rollback; + if (! sandbox_is_active()) { + if (set_max_file_descriptors((unsigned)options->ConnLimit, + &options->ConnLimit_) < 0) { + *msg = tor_strdup("Problem with ConnLimit value. " + "See logs for details."); + goto rollback; + } + set_conn_limit = 1; + } else { + tor_assert(old_options); + options->ConnLimit_ = old_options->ConnLimit_; } - set_conn_limit = 1; /* Set up libevent. (We need to do this before we can register the * listeners as listeners.) */

1 0

[tor/master] Don't reload logs or rewrite pidfile while sandbox is active
by nickm＠torproject.org 17 Apr '14

17 Apr '14

commit c80a6bd9d5cc341f822255050a24760d11cbd94a Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 16 16:26:20 2014 -0400 Don't reload logs or rewrite pidfile while sandbox is active --- src/or/config.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/src/or/config.c b/src/or/config.c index 881da37..77dcd16 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -1137,11 +1137,13 @@ options_act_reversible(const or_options_t *old_options, char **msg) if (!running_tor) goto commit; - mark_logs_temp(); /* Close current logs once new logs are open. */ - logs_marked = 1; - if (options_init_logs(options, 0)<0) { /* Configure the tor_log(s) */ - *msg = tor_strdup("Failed to init Log options. See logs for details."); - goto rollback; + if (!sandbox_is_active()) { + mark_logs_temp(); /* Close current logs once new logs are open. */ + logs_marked = 1; + if (options_init_logs(options, 0)<0) { /* Configure the tor_log(s) */ + *msg = tor_strdup("Failed to init Log options. See logs for details."); + goto rollback; + } } commit: @@ -1488,8 +1490,9 @@ options_act(const or_options_t *old_options) /* Write our PID to the PID file. If we do not have write permissions we * will log a warning */ - if (options->PidFile) + if (options->PidFile && !sandbox_is_active()) { write_pidfile(options->PidFile); + } /* Register addressmap directives */ config_register_addressmaps(options);

1 0

[tor/master] Sandbox: permit O_NONBLOCK and O_NOCTTY for files we refuse
by nickm＠torproject.org 17 Apr '14

17 Apr '14

commit f70cf9982ae3b0e57ca62612988478906707567f Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 16 21:50:49 2014 -0400 Sandbox: permit O_NONBLOCK and O_NOCTTY for files we refuse OpenSSL needs this, or RAND_poll() will kill the process. Also, refuse with EACCESS, not errno==-1 (!). --- src/common/sandbox.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 0722751..7067a72 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -363,8 +363,8 @@ sb_open(scmp_filter_ctx ctx, sandbox_cfg_t *filter) } } - rc = seccomp_rule_add_1(ctx, SCMP_ACT_ERRNO(-1), SCMP_SYS(open), - SCMP_CMP_MASKED(1, O_CLOEXEC, O_RDONLY)); + rc = seccomp_rule_add_1(ctx, SCMP_ACT_ERRNO(EACCES), SCMP_SYS(open), + SCMP_CMP_MASKED(1, O_CLOEXEC|O_NONBLOCK|O_NOCTTY, O_RDONLY)); if (rc != 0) { log_err(LD_BUG,"(Sandbox) failed to add open syscall, received libseccomp " "error %d", rc);

1 0

[tor/master] Merge remote-tracking branch 'andrea/bug11304'
by nickm＠torproject.org 17 Apr '14

17 Apr '14

commit c856193199151bf26208981f63ca723f9c4cf5d6 Merge: 74ddd5f 6ee9138 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 16 23:13:30 2014 -0400 Merge remote-tracking branch 'andrea/bug11304' changes/bug11304 | 5 +++++ src/or/connection.c | 6 ++++++ 2 files changed, 11 insertions(+)

1 0

[tor/master] Attribute 13304 and 13306 to 0.2.4.4-alpha.
by nickm＠torproject.org 17 Apr '14

17 Apr '14

commit 250b84b8a8b3bc9d50859459054aecfe8473e7cc Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 16 23:14:56 2014 -0400 Attribute 13304 and 13306 to 0.2.4.4-alpha. --- changes/bug11304 | 2 +- changes/bug11306 | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/changes/bug11304 b/changes/bug11304 index 2ea165f..4930dd6 100644 --- a/changes/bug11304 +++ b/changes/bug11304 @@ -2,4 +2,4 @@ - If write_to_buf() in connection_write_to_buf_impl_() ever fails, check if it's an or_connection_t and correctly call connection_or_close_for_error() rather than connection_mark_for_close() - directly. Fixes bug #11304. + directly. Fixes bug #11304; bugfix on 0.2.4.4-alpha. diff --git a/changes/bug11306 b/changes/bug11306 index bf8ea40..5937938 100644 --- a/changes/bug11306 +++ b/changes/bug11306 @@ -1,4 +1,4 @@ o Bugfixes: - When closing all connections on setting DisableNetwork to 1, use connection_or_close_normally() rather than closing orconns out from - under the channel layer. Fixes bug #11306. + under the channel layer. Fixes bug #11306; bugfix on 0.2.4.4-alpha.

1 0