December 2016 - tor-commits - lists.torproject.org

[tor/maint-0.2.9] Always Use EVP_aes_*_ctr() with openssl 1.1
by nickm＠torproject.org 05 Dec '16

05 Dec '16

commit 2a365413ebc7ab0055bd4c2fc11697666fc90f7b Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Nov 6 21:01:25 2016 -0500 Always Use EVP_aes_*_ctr() with openssl 1.1 (OpenSSL 1.1 makes EVP_CIPHER_CTX opaque, _and_ adds acceleration for counter mode on more architectures. So it won't work if we try the older approach, and it might help if we try the newer one.) Fixes bug 20588. --- changes/bug20588 | 3 +++ src/common/aes.c | 9 ++++++++- 2 … [View More]

1 0

[tor/release-0.2.9] Merge branch 'maint-0.2.9' into release-0.2.9
by nickm＠torproject.org 05 Dec '16

05 Dec '16

commit 4178708f3c4a8e2bd077e31c01f3b6ab50f6d445 Merge: 567852f 0d0c7a1 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Dec 5 08:05:45 2016 -0500 Merge branch 'maint-0.2.9' into release-0.2.9

1 0

[tor/release-0.2.8] Merge branch 'maint-0.2.8' into release-0.2.8
by nickm＠torproject.org 05 Dec '16

05 Dec '16

commit 5b336f2e0b792b2927b1d3bdc521d81221c5e157 Merge: eede3a1 2a36541 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Dec 5 08:04:04 2016 -0500 Merge branch 'maint-0.2.8' into release-0.2.8 changes/bug20588 | 3 +++ src/common/aes.c | 9 ++++++++- 2 files changed, 11 insertions(+), 1 deletion(-)

1 0

[tor/release-0.2.9] Always Use EVP_aes_*_ctr() with openssl 1.1
by nickm＠torproject.org 05 Dec '16

05 Dec '16

commit 2a365413ebc7ab0055bd4c2fc11697666fc90f7b Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Nov 6 21:01:25 2016 -0500 Always Use EVP_aes_*_ctr() with openssl 1.1 (OpenSSL 1.1 makes EVP_CIPHER_CTX opaque, _and_ adds acceleration for counter mode on more architectures. So it won't work if we try the older approach, and it might help if we try the newer one.) Fixes bug 20588. --- changes/bug20588 | 3 +++ src/common/aes.c | 9 ++++++++- 2 … [View More]

1 0

[tor/maint-0.2.8] Always Use EVP_aes_*_ctr() with openssl 1.1
by nickm＠torproject.org 05 Dec '16

05 Dec '16

commit 2a365413ebc7ab0055bd4c2fc11697666fc90f7b Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Nov 6 21:01:25 2016 -0500 Always Use EVP_aes_*_ctr() with openssl 1.1 (OpenSSL 1.1 makes EVP_CIPHER_CTX opaque, _and_ adds acceleration for counter mode on more architectures. So it won't work if we try the older approach, and it might help if we try the newer one.) Fixes bug 20588. --- changes/bug20588 | 3 +++ src/common/aes.c | 9 ++++++++- 2 … [View More]

1 0

[sandboxed-tor-browser/master] This is the first pass at trying to constrain resource use by sandboxed
by yawning＠torproject.org 05 Dec '16

05 Dec '16

commit 82fcc3247c878cff63bbf34fe0c397638a232bde Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Mon Dec 5 10:30:37 2016 +0000 This is the first pass at trying to constrain resource use by sandboxed processes. I still need to decide what to do about `RLIMIT_AS`, `RLIMIT_DATA`, and `RLIMIT_FSIZE`. I agree that setting them would be sensible, but it needs UI integration, which will take some thinking. --- src/cmd/gen-seccomp/seccomp_firefox.go … [View More] | 2 +- .../internal/sandbox/rlimit.go | 110 +++++++++++++++++++++ src/cmd/sandboxed-tor-browser/internal/ui/ui.go | 5 + 3 files changed, 116 insertions(+), 1 deletion(-) diff --git a/src/cmd/gen-seccomp/seccomp_firefox.go b/src/cmd/gen-seccomp/seccomp_firefox.go index 465d8fe..75a7dd3 100644 --- a/src/cmd/gen-seccomp/seccomp_firefox.go +++ b/src/cmd/gen-seccomp/seccomp_firefox.go @@ -117,7 +117,6 @@ func compileTorBrowserSeccompProfile(fd *os.File, is386 bool) error { "brk", "mincore", "mmap", - "mlock", "mprotect", "mremap", "munmap", @@ -182,6 +181,7 @@ func compileTorBrowserSeccompProfile(fd *os.File, is386 bool) error { // "vfork", // "memfd_create", (PulseAudio? Won't work in our container.) // "personality", + // "mlock", } if is386 { allowedNoArgs386 := []string{ diff --git a/src/cmd/sandboxed-tor-browser/internal/sandbox/rlimit.go b/src/cmd/sandboxed-tor-browser/internal/sandbox/rlimit.go new file mode 100644 index 0000000..9ac9aed --- /dev/null +++ b/src/cmd/sandboxed-tor-browser/internal/sandbox/rlimit.go @@ -0,0 +1,110 @@ +// rlimit.go - Resource limits. +// Copyright (C) 2016 Yawning Angel. +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as +// published by the Free Software Foundation, either version 3 of the +// License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see <http://www.gnu.org/licenses/>. + +package sandbox + +import "syscall" + +func lowerRlimit(resource int, newHard uint64) error { + var lim syscall.Rlimit + if err := syscall.Getrlimit(resource, &lim); err != nil { + return err + } + + needsSet := false + if newHard < lim.Max { + lim.Max = newHard + needsSet = true + } + if newHard < lim.Cur { + lim.Cur = newHard + needsSet = true + } + if !needsSet { + return nil + } + + return syscall.Setrlimit(resource, &lim) +} + +// SetSensibleRlimits conservatively lowers the rlimits to values that will +// happily support firefox, the updater, tor, and obfs4proxy. +// +// XXX; In the future, this should be applied to each process individually. +// I still need to think about what I'll do for the things that are unset, +// because it should be tied into the UI. +func SetSensibleRlimits() error { + const ( + limStack = 512 * 1024 // 512 KiB + limRSS = 0 // No effect as of 2.6.x... + limNproc = 512 + limNofile = 1024 // Could maybe go as low as 512... + limMlock = 0 // This might need to be increased later. + limLocks = 32 + limSigpending = 64 + limMsgqueue = 0 // Disallowed by seccomp. + limNice = 0 + limRtprio = 0 + limRttime = 0 + + // The syscall package doesn't expose these. + RLIMIT_RSS = 5 + RLIMIT_NPROC = 6 + RLIMIT_MLOCK = 8 + RLIMIT_LOCKS = 10 + RLIMIT_SIGPENDING = 11 + RLIMIT_MSGQUEUE = 12 + RLIMIT_NICE = 13 + RLIMIT_RTPRIO = 14 + RLIMIT_RTTIME = 15 + ) + + if err := lowerRlimit(syscall.RLIMIT_STACK, limStack); err != nil { + return err + } + if err := lowerRlimit(RLIMIT_RSS, limRSS); err != nil { + return err + } + if err := lowerRlimit(RLIMIT_NPROC, limNproc); err != nil { + return err + } + if err := lowerRlimit(syscall.RLIMIT_NOFILE, limNofile); err != nil { + return err + } + if err := lowerRlimit(RLIMIT_MLOCK, limMlock); err != nil { + return err + } + if err := lowerRlimit(RLIMIT_LOCKS, limLocks); err != nil { + return err + } + if err := lowerRlimit(RLIMIT_SIGPENDING, limSigpending); err != nil { + return err + } + if err := lowerRlimit(RLIMIT_MSGQUEUE, limMsgqueue); err != nil { + return err + } + if err := lowerRlimit(RLIMIT_NICE, limNice); err != nil { + return err + } + if err := lowerRlimit(RLIMIT_RTPRIO, limRtprio); err != nil { + return err + } + if err := lowerRlimit(RLIMIT_RTTIME, limRttime); err != nil { + return err + } + + return nil +} diff --git a/src/cmd/sandboxed-tor-browser/internal/ui/ui.go b/src/cmd/sandboxed-tor-browser/internal/ui/ui.go index b2ca8ee..cd9a8c1 100644 --- a/src/cmd/sandboxed-tor-browser/internal/ui/ui.go +++ b/src/cmd/sandboxed-tor-browser/internal/ui/ui.go @@ -206,6 +206,11 @@ func (c *Common) Run() error { log.SetOutput(w) } + // Set sensible rlimits. + if err = sandbox.SetSensibleRlimits(); err != nil { + return err + } + // Acquire the lock file. if c.lock, err = newLockFile(c); err != nil { return err [View Less]

1 0

[sandboxed-tor-browser/master] More seccomp whitelist improvements.
by yawning＠torproject.org 05 Dec '16

05 Dec '16

commit 783a170d62f30b3415f1746db6f264af85bd81f0 Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Mon Dec 5 08:18:14 2016 +0000 More seccomp whitelist improvements. * (General) Explicitly SIGKILL processes that try to use an unexpected ABI (eg: X32, x86_64 on x86 and vice versa). * (tor) Filter args to `fcntl[64]`, `accept4`. * (tor) `src/common/sandbox.c` things we need AF_NETLINK. Fuck that. --- src/cmd/gen-seccomp/seccomp.go | 3 ++ src/… [View More]cmd/gen-seccomp/seccomp_tor.go | 97 ++++++++++++++++++++++++++++++++++---- 2 files changed, 92 insertions(+), 8 deletions(-) diff --git a/src/cmd/gen-seccomp/seccomp.go b/src/cmd/gen-seccomp/seccomp.go index 6c7366f..62b286d 100644 --- a/src/cmd/gen-seccomp/seccomp.go +++ b/src/cmd/gen-seccomp/seccomp.go @@ -84,6 +84,9 @@ func newWhitelist(is386 bool) (*seccomp.ScmpFilter, error) { f.Release() return nil, err } + if err = f.SetBadArchAction(seccomp.ActKill); err != nil { + return nil, err + } return f, nil } diff --git a/src/cmd/gen-seccomp/seccomp_tor.go b/src/cmd/gen-seccomp/seccomp_tor.go index 73ed3c0..2b01656 100644 --- a/src/cmd/gen-seccomp/seccomp_tor.go +++ b/src/cmd/gen-seccomp/seccomp_tor.go @@ -43,7 +43,6 @@ func compileTorSeccompProfile(fd *os.File, useBridges bool, is386 bool) error { "eventfd2", "pipe2", "pipe", - "fcntl", "fstat", "getdents", "getdents64", @@ -84,10 +83,6 @@ func compileTorSeccompProfile(fd *os.File, useBridges bool, is386 bool) error { "sendto", "unlink", - // XXX: Calls that should be filtered by arg, but aren't yet. - "rt_sigaction", - "accept4", - // Calls that tor can filter, but I can't due to not being in // the tor daemon's process space. "chown", @@ -105,6 +100,7 @@ func compileTorSeccompProfile(fd *os.File, useBridges bool, is386 bool) error { "restart_syscall", "set_tid_address", "unshare", + "rt_sigaction", // Tor filters this but libc does more. } if is386 { allowedNoArgs386 := []string{ @@ -115,12 +111,11 @@ func compileTorSeccompProfile(fd *os.File, useBridges bool, is386 bool) error { "getuid32", "_llseek", "sigreturn", - "fcntl64", // XXX: Filter by arg. "recv", "send", "stat64", - "socketcall", // Sigh... (see accept4 in the tor code) + "socketcall", // Sigh... "ugetrlimit", "set_thread_area", @@ -161,6 +156,9 @@ func compileTorSeccompProfile(fd *os.File, useBridges bool, is386 bool) error { if err = allowCmpEq(f, "mremap", 3, mremapMaymove); err != nil { return err } + if err = torFilterAccept4(f, is386); err != nil { + return err + } if err = torFilterPoll(f); err != nil { return err } @@ -179,6 +177,9 @@ func compileTorSeccompProfile(fd *os.File, useBridges bool, is386 bool) error { if err = torFilterMmap(f, is386); err != nil { return err } + if err = torFilterFcntl(f, is386); err != nil { + return err + } if useBridges { // XXX: One day, all the PTs will live in their own containers. @@ -246,6 +247,25 @@ func torFilterPrctl(f *seccomp.ScmpFilter) error { return f.AddRuleConditional(scall, seccomp.ActAllow, []seccomp.ScmpCondition{isPrSetDeathsig}) } +func torFilterAccept4(f *seccomp.ScmpFilter, is386 bool) error { + scall, err := seccomp.GetSyscallFromName("accept4") + if err != nil { + return err + } + if is386 { + // XXX: The tor common/sandbox.c file, explcitly allows socketcall() + // by arg for this call, and only this call. ?????? + return f.AddRule(scall, seccomp.ActAllow) + } + + cond, err := seccomp.MakeCondition(3, seccomp.CompareMaskedEqual, 0, syscall.SOCK_CLOEXEC|syscall.SOCK_NONBLOCK) + if err != nil { + return nil + } + + return f.AddRuleConditional(scall, seccomp.ActAllow, []seccomp.ScmpCondition{cond}) +} + func torFilterPoll(f *seccomp.ScmpFilter) error { scall, err := seccomp.GetSyscallFromName("poll") if err != nil { @@ -273,7 +293,7 @@ func torFilterSocket(f *seccomp.ScmpFilter, is386 bool) error { } // XXX: Tighten this some more. - return allowCmpEq(f, "socket", 0, syscall.AF_UNIX, syscall.AF_INET, syscall.AF_INET6, syscall.AF_NETLINK) + return allowCmpEq(f, "socket", 0, syscall.AF_UNIX, syscall.AF_INET, syscall.AF_INET6 /*, syscall.AF_NETLINK */) } func torFilterSetsockopt(f *seccomp.ScmpFilter, is386 bool) error { @@ -447,6 +467,67 @@ func torFilterMmap(f *seccomp.ScmpFilter, is386 bool) error { return nil } +func torFilterFcntl(f *seccomp.ScmpFilter, is386 bool) error { + scallFcntl, err := seccomp.GetSyscallFromName("fcntl") + if err != nil { + return err + } + scalls := []seccomp.ScmpSyscall{scallFcntl} + if is386 { + scallFcntl64, err := seccomp.GetSyscallFromName("fcntl64") + if err != nil { + return err + } + scalls = append(scalls, scallFcntl64) + } + + isFGetfl, err := seccomp.MakeCondition(1, seccomp.CompareEqual, syscall.F_GETFL) + if err != nil { + return err + } + isFGetfd, err := seccomp.MakeCondition(1, seccomp.CompareEqual, syscall.F_GETFD) + if err != nil { + return err + } + + isFSetfl, err := seccomp.MakeCondition(1, seccomp.CompareEqual, syscall.F_SETFL) + if err != nil { + return err + } + isFSetflFlags, err := seccomp.MakeCondition(2, seccomp.CompareEqual, syscall.O_RDWR|syscall.O_NONBLOCK) + if err != nil { + return err + } + + isFSetfd, err := seccomp.MakeCondition(1, seccomp.CompareEqual, syscall.F_SETFD) + if err != nil { + return err + } + isFdCloexec, err := seccomp.MakeCondition(2, seccomp.CompareEqual, syscall.FD_CLOEXEC) + if err != nil { + return err + } + + for _, scall := range scalls { + if err = f.AddRuleConditional(scall, seccomp.ActAllow, []seccomp.ScmpCondition{isFGetfl}); err != nil { + return err + } + if err = f.AddRuleConditional(scall, seccomp.ActAllow, []seccomp.ScmpCondition{isFGetfd}); err != nil { + return err + } + + if err = f.AddRuleConditional(scall, seccomp.ActAllow, []seccomp.ScmpCondition{isFSetfl, isFSetflFlags}); err != nil { + return err + } + + if err = f.AddRuleConditional(scall, seccomp.ActAllow, []seccomp.ScmpCondition{isFSetfd, isFdCloexec}); err != nil { + return err + } + } + + return nil +} + func obfsFilterSetsockopt(f *seccomp.ScmpFilter, is386 bool) error { // 386 already blindly allows all setsockopt() calls. if is386 { [View Less]

1 0

[tor-browser/tor-browser-45.5.1esr-6.5-1] fixup! Bug #4234: Use the Firefox Update Process for Tor Browser.
by gk＠torproject.org 05 Dec '16

05 Dec '16

commit fdf24ff74128d674358878e998e8048306e48bb4 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Nov 18 12:01:44 2016 +0000 fixup! Bug #4234: Use the Firefox Update Process for Tor Browser. This fixes bug 20709. --- browser/app/profile/firefox.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/browser/app/profile/firefox.js b/browser/app/profile/firefox.js index 64ab700..ce16a75 100644 --- a/browser/app/profile/firefox.js +++ b/browser/app/profile/… [View More]

1 0

[tor-browser/tor-browser-45.5.1esr-6.5-1] Bug 20707: Avoid localization failure in about:preferences
by gk＠torproject.org 05 Dec '16

05 Dec '16

commit 94e3f300550ee9ee1e11f60b83b97e3e13d4de23 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Fri Nov 18 12:42:22 2016 -0800 Bug 20707: Avoid localization failure in about:preferences This fixes problem with our 20244 patches in non-US-English locales. If those patches are uplifted, then Mozilla can localize the strings. In the meantime, this patch removes our localizable strings from privacy.xul altogether. Our torbutton code overlays … [View More]

1 0

[tor-browser/tor-browser-45.5.1esr-6.5-1] Bug 16622: Pref to spoof time zone as UTC
by gk＠torproject.org 05 Dec '16

05 Dec '16

commit b3a3ef3688f3c196210d2004961fe2f8c5dba83b Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Mon Nov 14 10:22:09 2016 -0800 Bug 16622: Pref to spoof time zone as UTC --- toolkit/xre/nsAppRunner.cpp | 9 +++++++++ toolkit/xre/nsAppRunner.h | 3 +++ 2 files changed, 12 insertions(+) diff --git a/toolkit/xre/nsAppRunner.cpp b/toolkit/xre/nsAppRunner.cpp index f0cdd41..81f949a 100644 --- a/toolkit/xre/nsAppRunner.cpp +++ b/toolkit/xre/nsAppRunner.cpp @@ -4680,6 +… [View More]

1 0