commit a6688f9cbb930ad139a7f3886684fcadeec59d30
Author: Nick Mathewson <nickm(a)torproject.org>
Date: Thu May 29 11:04:32 2014 -0400
sandbox: allow enough setsockopt to make ConstrainedSockets work
fixes bug 12139; bugfix on 0.2.5.1-alpha
---
changes/bug12139 | 4 ++++
src/common/sandbox.c | 12 ++++++++++++
2 files changed, 16 insertions(+)
diff --git a/changes/bug12139 b/changes/bug12139
new file mode 100644
index 0000000..8d31dab
--- /dev/null
+++ b/changes/bug12139
@@ -0,0 +1,4 @@
+ o Minor bugfixes (linux seccomp sandbox):
+ - Avoid crashing with the seccomp sandbox enabled along with
+ ConstrainedSockets. Fixes bug 12139; bugfix on 0.2.5.1-alpha.
+
diff --git a/src/common/sandbox.c b/src/common/sandbox.c
index ba1956b..c379151 100644
--- a/src/common/sandbox.c
+++ b/src/common/sandbox.c
@@ -587,6 +587,18 @@ sb_setsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
if (rc)
return rc;
+ rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt),
+ SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET),
+ SCMP_CMP(2, SCMP_CMP_EQ, SO_SNDBUF));
+ if (rc)
+ return rc;
+
+ rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt),
+ SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET),
+ SCMP_CMP(2, SCMP_CMP_EQ, SO_RCVBUF));
+ if (rc)
+ return rc;
+
#ifdef IP_TRANSPARENT
rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt),
SCMP_CMP(1, SCMP_CMP_EQ, SOL_IP),