July 2016 - tor-commits - lists.torproject.org

[webwml/master] make torproject.org/PT shortlink for PT page
by sebastian＠torproject.org 13 Jul '16

13 Jul '16

commit d313e03608f86a0a37dc2dea599a09f8f6280250 Author: Nima Fatemi <nima(a)torproject.org> Date: Wed Jul 6 16:34:48 2016 +0000 make torproject.org/PT shortlink for PT page --- .htaccess | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.htaccess b/.htaccess index bf6a3dc..b85f8ee 100644 --- a/.htaccess +++ b/.htaccess @@ -30,6 +30,9 @@ RewriteRule ^press/index.html(.*) /press/press.html$1 [R=301,L] # Projects RewriteRule ^projects/$ /projects/projects [R=301,L] +#Pluggable Transports +RewriteRule ^PT/$ /docs/pluggable-transports [R=301,L] + # GetInvolved RewriteRule ^getinvolved/$ /getinvolved/volunteer [R=301,L] RewriteRule ^volunteer(.*) /getinvolved/volunteer$1 [R=301,L]

1 0

[translation/torbutton-torbuttondtd] Update translations for torbutton-torbuttondtd
by translation＠torproject.org 13 Jul '16

13 Jul '16

commit 3187e08b430a1aac6e8c9c673b953082bee1d113 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Jul 13 14:46:43 2016 +0000 Update translations for torbutton-torbuttondtd --- sk_SK/torbutton.dtd | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sk_SK/torbutton.dtd b/sk_SK/torbutton.dtd index 4f47519..83bc681 100644 --- a/sk_SK/torbutton.dtd +++ b/sk_SK/torbutton.dtd @@ -73,11 +73,11 @@ <!ENTITY torbutton.prefs.sec_svg_desc "Niektoré typy obrázkov su zakázané."> <!ENTITY torbutton.prefs.sec_svg_desc_tooltip "SVG obrázky sú zakázané."> <!ENTITY torbutton.prefs.sec_js_https_desc "JavaScript je v základnom nastavení zakázaný na všetkých nešifrovaných stránkach."> -<!ENTITY torbutton.prefs.sec_js_desc_tooltip "JavaScript can be enabled on a per-site basis via the NoScript toolbar button."> -<!ENTITY torbutton.prefs.sec_high "High"> +<!ENTITY torbutton.prefs.sec_js_desc_tooltip "JavaScript môže byť zapnuté na jednotlivých stránkach pomocou tlačítka NoScript na paneli nástrojov."> +<!ENTITY torbutton.prefs.sec_high "Vysoký"> <!ENTITY torbutton.prefs.sec_all_js_desc "JavaScript je v základnom nastavení zakázaný na všetkých stránkach."> <!ENTITY torbutton.prefs.sec_webfonts_desc "Niektoré písma a ikony sa môžu zobrazovať nesprávne."> <!ENTITY torbutton.prefs.sec_webfonts_desc_tooltip "Písma poskytnuté webovovou stránkou boli zablokované."> <!ENTITY torbutton.prefs.sec_custom "Vlastné hodnoty"> -<!ENTITY torbutton.circuit_display.title "Tor circuit for this site"> +<!ENTITY torbutton.circuit_display.title "Tor obvod pre túto stránku">

1 0

[translation/torbutton-torbuttondtd] Update translations for torbutton-torbuttondtd
by translation＠torproject.org 13 Jul '16

13 Jul '16

commit b28633f4495b3f78a1148923aa5e35c7e32a40b4 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Jul 13 14:16:54 2016 +0000 Update translations for torbutton-torbuttondtd --- sk_SK/torbutton.dtd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sk_SK/torbutton.dtd b/sk_SK/torbutton.dtd index d10be32..4f47519 100644 --- a/sk_SK/torbutton.dtd +++ b/sk_SK/torbutton.dtd @@ -69,7 +69,7 @@ <!ENTITY torbutton.prefs.sec_med_high "Stredne-vysoký"> <!ENTITY torbutton.prefs.sec_all_jit_desc "Všetky optimalizácie výkonu JavaScriptu sú zakázané."> <!ENTITY torbutton.prefs.sec_font_rend_desc "Niektoré vlastnosti renderovania písma sú vypnuté."> -<!ENTITY torbutton.prefs.sec_font_rend_graphite_tooltip "The Graphite font rendering mechanism is disabled."> +<!ENTITY torbutton.prefs.sec_font_rend_graphite_tooltip "Grafitový mechanizmus renderovania písma je vypnutý."> <!ENTITY torbutton.prefs.sec_svg_desc "Niektoré typy obrázkov su zakázané."> <!ENTITY torbutton.prefs.sec_svg_desc_tooltip "SVG obrázky sú zakázané."> <!ENTITY torbutton.prefs.sec_js_https_desc "JavaScript je v základnom nastavení zakázaný na všetkých nešifrovaných stránkach.">

1 0

[tor/maint-0.2.8] changes file for bug18397
by nickm＠torproject.org 13 Jul '16

13 Jul '16

commit c1bfa65211257e5efb89c5ebc534339d52fa77c4 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jul 13 09:19:23 2016 -0400 changes file for bug18397 --- changes/bug18397 | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/changes/bug18397 b/changes/bug18397 new file mode 100644 index 0000000..53993da --- /dev/null +++ b/changes/bug18397 @@ -0,0 +1,7 @@ + o Minor bugfixes (Linux seccomp2 sandbox): + - Add a few missing syscalls to the seccomp2 sandbox: sysinfo, + getsockopt(SO_SNDBUF), and setsockopt(SO_SNDBUFFORCE). On + some systems, these are required for Tor to start with + "Sandbox 1" enabled. + Fixes bug 18397; bugfix on 0.2.5.1-alpha. Patch from + Daniel Pinto.

1 0

[tor/maint-0.2.8] Merge remote-tracking branch 'Jigsaw52/seccomp-fix-18397' into maint-0.2.8
by nickm＠torproject.org 13 Jul '16

13 Jul '16

commit bb731ca665672c97aec7451921688381a2c8e9cb Merge: a931d15 20e89453 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jul 13 09:16:59 2016 -0400 Merge remote-tracking branch 'Jigsaw52/seccomp-fix-18397' into maint-0.2.8 src/common/sandbox.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --cc src/common/sandbox.c index 70c5bbd,b194c24..c0b994b --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@@ -207,11 -207,10 +207,15 @@@ static int filter_nopar_gen[] = // getaddrinfo uses this.. SCMP_SYS(stat64), #endif + +#ifdef __NR_getrandom + SCMP_SYS(getrandom), +#endif + + #ifdef __NR_sysinfo + // qsort uses this.. + SCMP_SYS(sysinfo), + #endif /* * These socket syscalls are not required on x86_64 and not supported with * some libseccomp versions (eg: 1.0.1)

1 0

[tor/maint-0.2.8] Adds missing syscalls to seccomp filter.
by nickm＠torproject.org 13 Jul '16

13 Jul '16

commit 20e89453fde13ef154b69674255b905dc2b85fd7 Author: Daniel Pinto <danielpinto52(a)gmail.com> Date: Sat Jul 9 00:36:37 2016 +0100 Adds missing syscalls to seccomp filter. Fixes #18397 which prevented tor starting with Sandbox 1. --- src/common/sandbox.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index bcbb3ce..b194c24 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -207,7 +207,10 @@ static int filter_nopar_gen[] = { // getaddrinfo uses this.. SCMP_SYS(stat64), #endif - +#ifdef __NR_sysinfo + // qsort uses this.. + SCMP_SYS(sysinfo), +#endif /* * These socket syscalls are not required on x86_64 and not supported with * some libseccomp versions (eg: 1.0.1) @@ -646,6 +649,14 @@ sb_setsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter) if (rc) return rc; +#ifdef HAVE_SYSTEMD + rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt), + SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET), + SCMP_CMP(2, SCMP_CMP_EQ, SO_SNDBUFFORCE)); + if (rc) + return rc; +#endif + #ifdef IP_TRANSPARENT rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt), SCMP_CMP(1, SCMP_CMP_EQ, SOL_IP), @@ -679,6 +690,14 @@ sb_getsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter) if (rc) return rc; +#ifdef HAVE_SYSTEMD + rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt), + SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET), + SCMP_CMP(2, SCMP_CMP_EQ, SO_SNDBUF)); + if (rc) + return rc; +#endif + #ifdef HAVE_LINUX_NETFILTER_IPV4_H rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt), SCMP_CMP(1, SCMP_CMP_EQ, SOL_IP),

1 0

[tor/master] Adds missing syscalls to seccomp filter.
by nickm＠torproject.org 13 Jul '16

13 Jul '16

commit 20e89453fde13ef154b69674255b905dc2b85fd7 Author: Daniel Pinto <danielpinto52(a)gmail.com> Date: Sat Jul 9 00:36:37 2016 +0100 Adds missing syscalls to seccomp filter. Fixes #18397 which prevented tor starting with Sandbox 1. --- src/common/sandbox.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index bcbb3ce..b194c24 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -207,7 +207,10 @@ static int filter_nopar_gen[] = { // getaddrinfo uses this.. SCMP_SYS(stat64), #endif - +#ifdef __NR_sysinfo + // qsort uses this.. + SCMP_SYS(sysinfo), +#endif /* * These socket syscalls are not required on x86_64 and not supported with * some libseccomp versions (eg: 1.0.1) @@ -646,6 +649,14 @@ sb_setsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter) if (rc) return rc; +#ifdef HAVE_SYSTEMD + rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt), + SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET), + SCMP_CMP(2, SCMP_CMP_EQ, SO_SNDBUFFORCE)); + if (rc) + return rc; +#endif + #ifdef IP_TRANSPARENT rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt), SCMP_CMP(1, SCMP_CMP_EQ, SOL_IP), @@ -679,6 +690,14 @@ sb_getsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter) if (rc) return rc; +#ifdef HAVE_SYSTEMD + rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt), + SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET), + SCMP_CMP(2, SCMP_CMP_EQ, SO_SNDBUF)); + if (rc) + return rc; +#endif + #ifdef HAVE_LINUX_NETFILTER_IPV4_H rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt), SCMP_CMP(1, SCMP_CMP_EQ, SOL_IP),

1 0

[tor/master] changes file for bug18397
by nickm＠torproject.org 13 Jul '16

13 Jul '16

commit c1bfa65211257e5efb89c5ebc534339d52fa77c4 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jul 13 09:19:23 2016 -0400 changes file for bug18397 --- changes/bug18397 | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/changes/bug18397 b/changes/bug18397 new file mode 100644 index 0000000..53993da --- /dev/null +++ b/changes/bug18397 @@ -0,0 +1,7 @@ + o Minor bugfixes (Linux seccomp2 sandbox): + - Add a few missing syscalls to the seccomp2 sandbox: sysinfo, + getsockopt(SO_SNDBUF), and setsockopt(SO_SNDBUFFORCE). On + some systems, these are required for Tor to start with + "Sandbox 1" enabled. + Fixes bug 18397; bugfix on 0.2.5.1-alpha. Patch from + Daniel Pinto.

1 0

[tor/release-0.2.8] Adds missing syscalls to seccomp filter.
by nickm＠torproject.org 13 Jul '16

13 Jul '16

commit 20e89453fde13ef154b69674255b905dc2b85fd7 Author: Daniel Pinto <danielpinto52(a)gmail.com> Date: Sat Jul 9 00:36:37 2016 +0100 Adds missing syscalls to seccomp filter. Fixes #18397 which prevented tor starting with Sandbox 1. --- src/common/sandbox.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index bcbb3ce..b194c24 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -207,7 +207,10 @@ static int filter_nopar_gen[] = { // getaddrinfo uses this.. SCMP_SYS(stat64), #endif - +#ifdef __NR_sysinfo + // qsort uses this.. + SCMP_SYS(sysinfo), +#endif /* * These socket syscalls are not required on x86_64 and not supported with * some libseccomp versions (eg: 1.0.1) @@ -646,6 +649,14 @@ sb_setsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter) if (rc) return rc; +#ifdef HAVE_SYSTEMD + rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt), + SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET), + SCMP_CMP(2, SCMP_CMP_EQ, SO_SNDBUFFORCE)); + if (rc) + return rc; +#endif + #ifdef IP_TRANSPARENT rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt), SCMP_CMP(1, SCMP_CMP_EQ, SOL_IP), @@ -679,6 +690,14 @@ sb_getsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter) if (rc) return rc; +#ifdef HAVE_SYSTEMD + rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt), + SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET), + SCMP_CMP(2, SCMP_CMP_EQ, SO_SNDBUF)); + if (rc) + return rc; +#endif + #ifdef HAVE_LINUX_NETFILTER_IPV4_H rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt), SCMP_CMP(1, SCMP_CMP_EQ, SOL_IP),

1 0

[tor/master] Merge branch 'maint-0.2.8'
by nickm＠torproject.org 13 Jul '16

13 Jul '16

commit 9932544297e02dc4f79d70317f214bcbb2dd8e9a Merge: 3ac4341 c1bfa65 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jul 13 09:19:35 2016 -0400 Merge branch 'maint-0.2.8' changes/bug18397 | 7 +++++++ src/common/sandbox.c | 20 ++++++++++++++++++++ 2 files changed, 27 insertions(+)

1 0