November 2017 - tor-commits - lists.torproject.org

[tor/release-0.3.2] Merge branch 'maint-0.3.2' into release-0.3.2
by nickm＠torproject.org 20 Nov '17

20 Nov '17

commit e343cb8f631dbbad2fbe9814d558ac06bc46a8e8 Merge: 1bd83c2ec e2d8300c1 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 20 14:25:17 2017 -0500 Merge branch 'maint-0.3.2' into release-0.3.2 changes/bug23783 | 5 +++++ configure.ac | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-)

1 0

[tor/release-0.3.2] Make our seccomp2 sandbox handle Glibc 2.26
by nickm＠torproject.org 20 Nov '17

20 Nov '17

commit d2d6a1b082fa0eac8b6478889a0c28bf05e48073 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 16 13:53:48 2017 -0500 Make our seccomp2 sandbox handle Glibc 2.26 There are three changes here: * We need to allow epoll_pwait. * We need to allow PF_NETLINK sockets to be opened with SOCK_CLOEXEC. * We need to use openat() instead of open(). Note that this fix is not complete, since the openat() change is turned off. The next … [View More]commit will make the openat() change happen when we're running glibc 2.26 or later. Fix for 24315. --- src/common/sandbox.c | 35 +++++++++++++++++++++++++++++++---- 1 file changed, 31 insertions(+), 4 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 7f4511db2..417c1e305 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -127,6 +127,9 @@ static int filter_nopar_gen[] = { SCMP_SYS(clone), SCMP_SYS(epoll_create), SCMP_SYS(epoll_wait), +#ifdef __NR_epoll_pwait + SCMP_SYS(epoll_pwait), +#endif #ifdef HAVE_EVENTFD SCMP_SYS(eventfd2), #endif @@ -421,6 +424,21 @@ sb_mmap2(scmp_filter_ctx ctx, sandbox_cfg_t *filter) } #endif +/** Allow a single file to be opened. If use_openat is true, + * we're using a libc that remaps all the opens into openats. */ +static int +allow_file_open(scmp_filter_ctx ctx, int use_openat, const char *file) +{ + if (use_openat) { + return seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(openat), + SCMP_CMP_STR(0, SCMP_CMP_EQ, AT_FDCWD), + SCMP_CMP_STR(1, SCMP_CMP_EQ, file)); + } else { + return seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(open), + SCMP_CMP_STR(0, SCMP_CMP_EQ, file)); + } +} + /** * Function responsible for setting up the open syscall for * the seccomp filter sandbox. @@ -437,8 +455,7 @@ sb_open(scmp_filter_ctx ctx, sandbox_cfg_t *filter) if (param != NULL && param->prot == 1 && param->syscall == SCMP_SYS(open)) { - rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(open), - SCMP_CMP_STR(0, SCMP_CMP_EQ, param->value)); + rc = allow_file_open(ctx, 0 /* XXXX */, param->value); if (rc != 0) { log_err(LD_BUG,"(Sandbox) failed to add open syscall, received " "libseccomp error %d", rc); @@ -456,6 +473,15 @@ sb_open(scmp_filter_ctx ctx, sandbox_cfg_t *filter) return rc; } + rc = seccomp_rule_add_1(ctx, SCMP_ACT_ERRNO(EACCES), SCMP_SYS(openat), + SCMP_CMP_MASKED(2, O_CLOEXEC|O_NONBLOCK|O_NOCTTY|O_NOFOLLOW, + O_RDONLY)); + if (rc != 0) { + log_err(LD_BUG,"(Sandbox) failed to add openat syscall, received " + "libseccomp error %d", rc); + return rc; + } + return 0; } @@ -645,7 +671,7 @@ sb_socket(scmp_filter_ctx ctx, sandbox_cfg_t *filter) rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), SCMP_CMP(0, SCMP_CMP_EQ, PF_NETLINK), - SCMP_CMP(1, SCMP_CMP_EQ, SOCK_RAW), + SCMP_CMP_MASKED(1, SOCK_CLOEXEC, SOCK_RAW), SCMP_CMP(2, SCMP_CMP_EQ, 0)); if (rc) return rc; @@ -1616,7 +1642,8 @@ add_param_filter(scmp_filter_ctx ctx, sandbox_cfg_t* cfg) // function pointer for (i = 0; i < ARRAY_LENGTH(filter_func); i++) { - if ((filter_func[i])(ctx, cfg)) { + rc = filter_func[i](ctx, cfg); + if (rc) { log_err(LD_BUG,"(Sandbox) failed to add syscall %d, received libseccomp " "error %d", i, rc); return rc; [View Less]

1 0

[tor/release-0.3.2] Add a changes file.
by nickm＠torproject.org 20 Nov '17

20 Nov '17

commit 80bf270404a52c634a14f6aad594dec4e9ce1e12 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 16 14:07:58 2017 -0500 Add a changes file. --- changes/ticket24315 | 3 +++ 1 file changed, 3 insertions(+) diff --git a/changes/ticket24315 b/changes/ticket24315 new file mode 100644 index 000000000..df34dbf41 --- /dev/null +++ b/changes/ticket24315 @@ -0,0 +1,3 @@ + o Major features (linux seccomp2 sandbox): + - Update the sandbox rules so that they should now work … [View More]

1 0

[tor/release-0.3.2] Permit kill(pid, 0) in the seccomp2 sandbox.
by nickm＠torproject.org 20 Nov '17

20 Nov '17

commit 7461cd30676da62324271ddd7b7d347eeff40266 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 16 12:44:47 2017 -0500 Permit kill(pid, 0) in the seccomp2 sandbox. We don't want to allow general signals to be sent, but there's no problem sending a kill(0) to probe whether a process is there. Fixes bug 24198; bugfix on 0.2.5.1-alpha when the seccomp2 sandbox was introduced. --- changes/bug24198 | 4 ++++ src/common/sandbox.c | 16 ++++++++… [View More]

1 0

[tor/release-0.3.2] Check the libc version to decide whether to allow openat.
by nickm＠torproject.org 20 Nov '17

20 Nov '17

commit 2d3904aba67e79e57db1814033b1df3f77336065 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 16 14:06:38 2017 -0500 Check the libc version to decide whether to allow openat. --- configure.ac | 2 ++ src/common/sandbox.c | 38 +++++++++++++++++++++++++++++++++++++- 2 files changed, 39 insertions(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac index f2c3f90ba..3ff819052 100644 --- a/configure.ac +++ b/configure.ac @@ -390,6 +390,7 @@ … [View More]AC_CHECK_FUNCS( getrlimit \ gettimeofday \ gmtime_r \ + gnu_get_libc_version \ htonll \ inet_aton \ ioctl \ @@ -1011,6 +1012,7 @@ AC_CHECK_HEADERS([assert.h \ arpa/inet.h \ crt_externs.h \ execinfo.h \ + gnu/libc-version.h \ grp.h \ ifaddrs.h \ inttypes.h \ diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 417c1e305..d0ead2cae 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -56,6 +56,9 @@ #include <time.h> #include <poll.h> +#ifdef HAVE_GNU_LIBC_VERSION_H +#include <gnu/libc-version.h> +#endif #ifdef HAVE_LINUX_NETFILTER_IPV4_H #include <linux/netfilter_ipv4.h> #endif @@ -424,6 +427,37 @@ sb_mmap2(scmp_filter_ctx ctx, sandbox_cfg_t *filter) } #endif +#ifdef HAVE_GNU_LIBC_VERSION_H +#ifdef HAVE_GNU_GET_LIBC_VERSION +#define CHECK_LIBC_VERSION +#endif +#endif + +/* Return true if we think we're running with a libc that always uses + * openat on linux. */ +static int +libc_uses_openat_for_everything(void) +{ +#ifdef CHECK_LIBC_VERSION + const char *version = gnu_get_libc_version(); + if (version == NULL) + return 0; + + int major = -1; + int minor = -1; + + tor_sscanf(version, "%d.%d", &major, &minor); + if (major >= 3) + return 1; + else if (major == 2 && minor >= 26) + return 1; + else + return 0; +#else + return 0; +#endif +} + /** Allow a single file to be opened. If use_openat is true, * we're using a libc that remaps all the opens into openats. */ static int @@ -449,13 +483,15 @@ sb_open(scmp_filter_ctx ctx, sandbox_cfg_t *filter) int rc; sandbox_cfg_t *elem = NULL; + int use_openat = libc_uses_openat_for_everything(); + // for each dynamic parameter filters for (elem = filter; elem != NULL; elem = elem->next) { smp_param_t *param = elem->param; if (param != NULL && param->prot == 1 && param->syscall == SCMP_SYS(open)) { - rc = allow_file_open(ctx, 0 /* XXXX */, param->value); + rc = allow_file_open(ctx, use_openat, param->value); if (rc != 0) { log_err(LD_BUG,"(Sandbox) failed to add open syscall, received " "libseccomp error %d", rc); [View Less]

1 0

[tor/release-0.3.2] Merge branch 'maint-0.3.2' into release-0.3.2
by nickm＠torproject.org 20 Nov '17

20 Nov '17

commit 1bd83c2ec846764a52f4fd001662f7fb1a1a43f8 Merge: 909645449 846df5b3c Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 20 13:22:10 2017 -0500 Merge branch 'maint-0.3.2' into release-0.3.2 changes/bug24198 | 4 +++ changes/ticket24315 | 3 ++ configure.ac | 2 ++ src/common/sandbox.c | 86 +++++++++++++++++++++++++++++++++++++++++++++++++--- 4 files changed, 90 insertions(+), 5 deletions(-)

1 0

[tor/release-0.3.2] Merge remote-tracking branches 'public/ticket24315_029' and 'public/bug24198_029' into maint-0.3.2
by nickm＠torproject.org 20 Nov '17

20 Nov '17

commit 846df5b3cdd94ca57777c3e1cbdd81a25e9b5154 Merge: e0f7a2dbd 80bf27040 7461cd306 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 20 13:20:25 2017 -0500 Merge remote-tracking branches 'public/ticket24315_029' and 'public/bug24198_029' into maint-0.3.2 changes/bug24198 | 4 +++ changes/ticket24315 | 3 ++ configure.ac | 2 ++ src/common/sandbox.c | 86 +++++++++++++++++++++++++++++++++++++++++++++++++--- 4 files changed, 90 insertions(+), 5 … [View More]deletions(-) diff --cc src/common/sandbox.c index 7a4e3ece3,d0ead2cae,0b862a549..0fd129d22 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@@@ -394,8 -425,54 -419,8 +400,54 @@@@ sb_mmap2(scmp_filter_ctx ctx, sandbox_c return 0; } - #endif ++#endif /* defined(__NR_mmap2) */ + + +#ifdef HAVE_GNU_LIBC_VERSION_H + +#ifdef HAVE_GNU_GET_LIBC_VERSION + +#define CHECK_LIBC_VERSION + +#endif + #endif + + +/* Return true if we think we're running with a libc that always uses + + * openat on linux. */ + +static int + +libc_uses_openat_for_everything(void) + +{ + +#ifdef CHECK_LIBC_VERSION + + const char *version = gnu_get_libc_version(); + + if (version == NULL) + + return 0; + + + + int major = -1; + + int minor = -1; + + + + tor_sscanf(version, "%d.%d", &major, &minor); + + if (major >= 3) + + return 1; + + else if (major == 2 && minor >= 26) + + return 1; + + else + + return 0; + +#else + + return 0; + +#endif + +} + + + +/** Allow a single file to be opened. If use_openat is true, + + * we're using a libc that remaps all the opens into openats. */ + +static int + +allow_file_open(scmp_filter_ctx ctx, int use_openat, const char *file) + +{ + + if (use_openat) { + + return seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(openat), + + SCMP_CMP_STR(0, SCMP_CMP_EQ, AT_FDCWD), + + SCMP_CMP_STR(1, SCMP_CMP_EQ, file)); + + } else { + + return seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(open), + + SCMP_CMP_STR(0, SCMP_CMP_EQ, file)); + + } + +} + + /** * Function responsible for setting up the open syscall for * the seccomp filter sandbox. @@@@ -1051,8 -1110,8 -1048,21 +1113,21 @@@@ sb_stat64(scmp_filter_ctx ctx, sandbox_ return 0; } -#endif ++#endif /* defined(__NR_stat64) */ + ++ static int ++ sb_kill(scmp_filter_ctx ctx, sandbox_cfg_t *filter) ++ { ++ (void) filter; ++ #ifdef __NR_kill ++ /* Allow killing anything with signal 0 -- it isn't really a kill. */ ++ return seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(kill), ++ SCMP_CMP(1, SCMP_CMP_EQ, 0)); ++ #else ++ return 0; + #endif ++ } + /** * Array of function pointers responsible for filtering different syscalls at * a parameter level. @@@@ -1088,11 -1150,7 -1101,8 +1163,11 @@@@ static sandbox_filter_func_t filter_fun sb_socket, sb_setsockopt, sb_getsockopt, - sb_socketpair + sb_socketpair, - ++#ifdef HAVE_KIST_SUPPORT ++ sb_ioctl, ++#endif ++ sb_kill }; const char * [View Less]

1 0

[tor/maint-0.3.2] Add a changes file.
by nickm＠torproject.org 20 Nov '17

20 Nov '17

commit 80bf270404a52c634a14f6aad594dec4e9ce1e12 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 16 14:07:58 2017 -0500 Add a changes file. --- changes/ticket24315 | 3 +++ 1 file changed, 3 insertions(+) diff --git a/changes/ticket24315 b/changes/ticket24315 new file mode 100644 index 000000000..df34dbf41 --- /dev/null +++ b/changes/ticket24315 @@ -0,0 +1,3 @@ + o Major features (linux seccomp2 sandbox): + - Update the sandbox rules so that they should now work … [View More]

1 0

[tor/master] Check the libc version to decide whether to allow openat.
by nickm＠torproject.org 20 Nov '17

20 Nov '17

commit 2d3904aba67e79e57db1814033b1df3f77336065 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 16 14:06:38 2017 -0500 Check the libc version to decide whether to allow openat. --- configure.ac | 2 ++ src/common/sandbox.c | 38 +++++++++++++++++++++++++++++++++++++- 2 files changed, 39 insertions(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac index f2c3f90ba..3ff819052 100644 --- a/configure.ac +++ b/configure.ac @@ -390,6 +390,7 @@ … [View More]AC_CHECK_FUNCS( getrlimit \ gettimeofday \ gmtime_r \ + gnu_get_libc_version \ htonll \ inet_aton \ ioctl \ @@ -1011,6 +1012,7 @@ AC_CHECK_HEADERS([assert.h \ arpa/inet.h \ crt_externs.h \ execinfo.h \ + gnu/libc-version.h \ grp.h \ ifaddrs.h \ inttypes.h \ diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 417c1e305..d0ead2cae 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -56,6 +56,9 @@ #include <time.h> #include <poll.h> +#ifdef HAVE_GNU_LIBC_VERSION_H +#include <gnu/libc-version.h> +#endif #ifdef HAVE_LINUX_NETFILTER_IPV4_H #include <linux/netfilter_ipv4.h> #endif @@ -424,6 +427,37 @@ sb_mmap2(scmp_filter_ctx ctx, sandbox_cfg_t *filter) } #endif +#ifdef HAVE_GNU_LIBC_VERSION_H +#ifdef HAVE_GNU_GET_LIBC_VERSION +#define CHECK_LIBC_VERSION +#endif +#endif + +/* Return true if we think we're running with a libc that always uses + * openat on linux. */ +static int +libc_uses_openat_for_everything(void) +{ +#ifdef CHECK_LIBC_VERSION + const char *version = gnu_get_libc_version(); + if (version == NULL) + return 0; + + int major = -1; + int minor = -1; + + tor_sscanf(version, "%d.%d", &major, &minor); + if (major >= 3) + return 1; + else if (major == 2 && minor >= 26) + return 1; + else + return 0; +#else + return 0; +#endif +} + /** Allow a single file to be opened. If use_openat is true, * we're using a libc that remaps all the opens into openats. */ static int @@ -449,13 +483,15 @@ sb_open(scmp_filter_ctx ctx, sandbox_cfg_t *filter) int rc; sandbox_cfg_t *elem = NULL; + int use_openat = libc_uses_openat_for_everything(); + // for each dynamic parameter filters for (elem = filter; elem != NULL; elem = elem->next) { smp_param_t *param = elem->param; if (param != NULL && param->prot == 1 && param->syscall == SCMP_SYS(open)) { - rc = allow_file_open(ctx, 0 /* XXXX */, param->value); + rc = allow_file_open(ctx, use_openat, param->value); if (rc != 0) { log_err(LD_BUG,"(Sandbox) failed to add open syscall, received " "libseccomp error %d", rc); [View Less]

1 0

[tor/master] Merge remote-tracking branches 'public/ticket24315_029' and 'public/bug24198_029' into maint-0.3.2
by nickm＠torproject.org 20 Nov '17

20 Nov '17

commit 846df5b3cdd94ca57777c3e1cbdd81a25e9b5154 Merge: e0f7a2dbd 80bf27040 7461cd306 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 20 13:20:25 2017 -0500 Merge remote-tracking branches 'public/ticket24315_029' and 'public/bug24198_029' into maint-0.3.2 changes/bug24198 | 4 +++ changes/ticket24315 | 3 ++ configure.ac | 2 ++ src/common/sandbox.c | 86 +++++++++++++++++++++++++++++++++++++++++++++++++--- 4 files changed, 90 insertions(+), 5 … [View More]deletions(-) diff --cc src/common/sandbox.c index 7a4e3ece3,d0ead2cae,0b862a549..0fd129d22 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@@@ -394,8 -425,54 -419,8 +400,54 @@@@ sb_mmap2(scmp_filter_ctx ctx, sandbox_c return 0; } - #endif ++#endif /* defined(__NR_mmap2) */ + + +#ifdef HAVE_GNU_LIBC_VERSION_H + +#ifdef HAVE_GNU_GET_LIBC_VERSION + +#define CHECK_LIBC_VERSION + +#endif + #endif + + +/* Return true if we think we're running with a libc that always uses + + * openat on linux. */ + +static int + +libc_uses_openat_for_everything(void) + +{ + +#ifdef CHECK_LIBC_VERSION + + const char *version = gnu_get_libc_version(); + + if (version == NULL) + + return 0; + + + + int major = -1; + + int minor = -1; + + + + tor_sscanf(version, "%d.%d", &major, &minor); + + if (major >= 3) + + return 1; + + else if (major == 2 && minor >= 26) + + return 1; + + else + + return 0; + +#else + + return 0; + +#endif + +} + + + +/** Allow a single file to be opened. If use_openat is true, + + * we're using a libc that remaps all the opens into openats. */ + +static int + +allow_file_open(scmp_filter_ctx ctx, int use_openat, const char *file) + +{ + + if (use_openat) { + + return seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(openat), + + SCMP_CMP_STR(0, SCMP_CMP_EQ, AT_FDCWD), + + SCMP_CMP_STR(1, SCMP_CMP_EQ, file)); + + } else { + + return seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(open), + + SCMP_CMP_STR(0, SCMP_CMP_EQ, file)); + + } + +} + + /** * Function responsible for setting up the open syscall for * the seccomp filter sandbox. @@@@ -1051,8 -1110,8 -1048,21 +1113,21 @@@@ sb_stat64(scmp_filter_ctx ctx, sandbox_ return 0; } -#endif ++#endif /* defined(__NR_stat64) */ + ++ static int ++ sb_kill(scmp_filter_ctx ctx, sandbox_cfg_t *filter) ++ { ++ (void) filter; ++ #ifdef __NR_kill ++ /* Allow killing anything with signal 0 -- it isn't really a kill. */ ++ return seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(kill), ++ SCMP_CMP(1, SCMP_CMP_EQ, 0)); ++ #else ++ return 0; + #endif ++ } + /** * Array of function pointers responsible for filtering different syscalls at * a parameter level. @@@@ -1088,11 -1150,7 -1101,8 +1163,11 @@@@ static sandbox_filter_func_t filter_fun sb_socket, sb_setsockopt, sb_getsockopt, - sb_socketpair + sb_socketpair, - ++#ifdef HAVE_KIST_SUPPORT ++ sb_ioctl, ++#endif ++ sb_kill }; const char * [View Less]

1 0