commit b8534e56ad75c4b66783c8b14fcc8cf38687a6c5
Author: Yawning Angel <yawning(a)schwanenlied.me>
Date: Sat Dec 3 23:28:48 2016 +0000
Allow ugetrlimit, and remove the getrlimit hook.
I still have no idea, but at this point I'm going to write it off to:
"My system call whitelist didn't have enough things on it for i386".
---
data/tor-whitelist-extras-i386.seccomp | 2 ++
...rbrowser-launcher-whitelist-extras-i386.seccomp | 1 +
src/tbb_stub/tbb_stub.c | 28 ++--------------------
3 files changed, 5 insertions(+), 26 deletions(-)
diff --git a/data/tor-whitelist-extras-i386.seccomp b/data/tor-whitelist-extras-i386.seccomp
index 03204c3..b3a13f7 100644
--- a/data/tor-whitelist-extras-i386.seccomp
+++ b/data/tor-whitelist-extras-i386.seccomp
@@ -13,6 +13,8 @@ mmap2: 1
fcntl64: 1
stat64: 1
+ugetrlimit: 1
+
# tor's sandbox code claims that these calls are required on x86 but not on
# x86_64. tor's sandbox attempts to filter socketcall's arguments as well
# when it adds a rule, but seccomp on x86 does not support argument filtering,
diff --git a/data/torbrowser-launcher-whitelist-extras-i386.seccomp b/data/torbrowser-launcher-whitelist-extras-i386.seccomp
index 4d685b6..b859f69 100644
--- a/data/torbrowser-launcher-whitelist-extras-i386.seccomp
+++ b/data/torbrowser-launcher-whitelist-extras-i386.seccomp
@@ -19,6 +19,7 @@ getresgid32: 1
time: 1
getuid32: 1
getgid32: 1
+ugetrlimit: 1
recv: 1
send: 1
diff --git a/src/tbb_stub/tbb_stub.c b/src/tbb_stub/tbb_stub.c
index e431222..0f714b7 100644
--- a/src/tbb_stub/tbb_stub.c
+++ b/src/tbb_stub/tbb_stub.c
@@ -48,10 +48,7 @@
#include <stdlib.h>
#include <X11/Xlib.h>
-#ifdef __i386__
-#include <sys/time.h>
-#include <sys/resource.h>
-#else
+#ifndef __i386__
#include <glob.h>
#include <stdbool.h>
#endif
@@ -179,28 +176,7 @@ XQueryExtension(Display *display, _Xconst char *name, int *major, int *event, in
return real_XQueryExtension(display, name, major, event, error);
}
-#ifdef __i386__
-
-static int (*real_getrlimit)(__rlimit_resource_t, struct rlimit *);
-
-int
-getrlimit(__rlimit_resource_t resource, struct rlimit *rlim)
-{
- /* I have no fucking idea why, on i386 systems rlimit starts failing
- * randomly deep inside firefox, even with the appropriate system calls
- * whitelisted. Hooking it, makes the problem go away for extra fun.
- */
- if (real_getrlimit == NULL) {
- if ((real_getrlimit = dlsym(RTLD_NEXT, "getrlimit")) == NULL) {
- fprintf(stderr, "ERROR: Failed to find `getrlimit() symbol: %s\n", dlerror());
- abort();
- }
- }
-
- return real_getrlimit(resource, rlim);
-}
-
-#else
+#ifndef __i386__
typedef struct pa_mutex pm;
static pm* (*real_pa_mutex_new)(bool, bool);