February 2018 - tor-commits - lists.torproject.org

[tor/release-0.3.2] Merge branch 'maint-0.2.9' into maint-0.3.1
by nickm＠torproject.org 11 Feb '18

11 Feb '18

commit 8939eaf479bc123e774421c9de6dfc3c864e0326 Merge: eccef6ba6 848ba26c1 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Feb 11 18:09:35 2018 -0500 Merge branch 'maint-0.2.9' into maint-0.3.1 changes/ticket24315 | 3 +++ configure.ac | 2 ++ src/common/sandbox.c | 71 +++++++++++++++++++++++++++++++++++++++++++++++++--- 3 files changed, 72 insertions(+), 4 deletions(-)

1 0

[tor/release-0.3.1] Merge branch 'maint-0.3.1' into release-0.3.1
by nickm＠torproject.org 11 Feb '18

11 Feb '18

commit c93f69af582141f846a0f7c5dfd30c293c901c58 Merge: cf55f0516 8939eaf47 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Feb 11 18:09:35 2018 -0500 Merge branch 'maint-0.3.1' into release-0.3.1 changes/ticket24315 | 3 +++ configure.ac | 2 ++ src/common/sandbox.c | 71 +++++++++++++++++++++++++++++++++++++++++++++++++--- 3 files changed, 72 insertions(+), 4 deletions(-)

1 0

[tor/release-0.3.2] Merge branch 'maint-0.3.1' into maint-0.3.2
by nickm＠torproject.org 11 Feb '18

11 Feb '18

commit 67043d957f2f3cc107c5e0cb3f5c2caa35639506 Merge: 684d57fe8 8939eaf47 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Feb 11 18:09:35 2018 -0500 Merge branch 'maint-0.3.1' into maint-0.3.2

1 0

[tor/release-0.3.2] Merge branch 'ticket24315_029' into maint-0.2.9
by nickm＠torproject.org 11 Feb '18

11 Feb '18

commit 848ba26c188c43cb97a22d5911fceb3714a97272 Merge: 5dc785cee 80bf27040 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Feb 11 18:07:37 2018 -0500 Merge branch 'ticket24315_029' into maint-0.2.9 changes/ticket24315 | 3 +++ configure.ac | 2 ++ src/common/sandbox.c | 71 +++++++++++++++++++++++++++++++++++++++++++++++++--- 3 files changed, 72 insertions(+), 4 deletions(-)

1 0

[tor/maint-0.2.9] Make our seccomp2 sandbox handle Glibc 2.26
by nickm＠torproject.org 11 Feb '18

11 Feb '18

commit d2d6a1b082fa0eac8b6478889a0c28bf05e48073 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 16 13:53:48 2017 -0500 Make our seccomp2 sandbox handle Glibc 2.26 There are three changes here: * We need to allow epoll_pwait. * We need to allow PF_NETLINK sockets to be opened with SOCK_CLOEXEC. * We need to use openat() instead of open(). Note that this fix is not complete, since the openat() change is turned off. The next commit will make the openat() change happen when we're running glibc 2.26 or later. Fix for 24315. --- src/common/sandbox.c | 35 +++++++++++++++++++++++++++++++---- 1 file changed, 31 insertions(+), 4 deletions(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 7f4511db2..417c1e305 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -127,6 +127,9 @@ static int filter_nopar_gen[] = { SCMP_SYS(clone), SCMP_SYS(epoll_create), SCMP_SYS(epoll_wait), +#ifdef __NR_epoll_pwait + SCMP_SYS(epoll_pwait), +#endif #ifdef HAVE_EVENTFD SCMP_SYS(eventfd2), #endif @@ -421,6 +424,21 @@ sb_mmap2(scmp_filter_ctx ctx, sandbox_cfg_t *filter) } #endif +/** Allow a single file to be opened. If use_openat is true, + * we're using a libc that remaps all the opens into openats. */ +static int +allow_file_open(scmp_filter_ctx ctx, int use_openat, const char *file) +{ + if (use_openat) { + return seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(openat), + SCMP_CMP_STR(0, SCMP_CMP_EQ, AT_FDCWD), + SCMP_CMP_STR(1, SCMP_CMP_EQ, file)); + } else { + return seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(open), + SCMP_CMP_STR(0, SCMP_CMP_EQ, file)); + } +} + /** * Function responsible for setting up the open syscall for * the seccomp filter sandbox. @@ -437,8 +455,7 @@ sb_open(scmp_filter_ctx ctx, sandbox_cfg_t *filter) if (param != NULL && param->prot == 1 && param->syscall == SCMP_SYS(open)) { - rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(open), - SCMP_CMP_STR(0, SCMP_CMP_EQ, param->value)); + rc = allow_file_open(ctx, 0 /* XXXX */, param->value); if (rc != 0) { log_err(LD_BUG,"(Sandbox) failed to add open syscall, received " "libseccomp error %d", rc); @@ -456,6 +473,15 @@ sb_open(scmp_filter_ctx ctx, sandbox_cfg_t *filter) return rc; } + rc = seccomp_rule_add_1(ctx, SCMP_ACT_ERRNO(EACCES), SCMP_SYS(openat), + SCMP_CMP_MASKED(2, O_CLOEXEC|O_NONBLOCK|O_NOCTTY|O_NOFOLLOW, + O_RDONLY)); + if (rc != 0) { + log_err(LD_BUG,"(Sandbox) failed to add openat syscall, received " + "libseccomp error %d", rc); + return rc; + } + return 0; } @@ -645,7 +671,7 @@ sb_socket(scmp_filter_ctx ctx, sandbox_cfg_t *filter) rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), SCMP_CMP(0, SCMP_CMP_EQ, PF_NETLINK), - SCMP_CMP(1, SCMP_CMP_EQ, SOCK_RAW), + SCMP_CMP_MASKED(1, SOCK_CLOEXEC, SOCK_RAW), SCMP_CMP(2, SCMP_CMP_EQ, 0)); if (rc) return rc; @@ -1616,7 +1642,8 @@ add_param_filter(scmp_filter_ctx ctx, sandbox_cfg_t* cfg) // function pointer for (i = 0; i < ARRAY_LENGTH(filter_func); i++) { - if ((filter_func[i])(ctx, cfg)) { + rc = filter_func[i](ctx, cfg); + if (rc) { log_err(LD_BUG,"(Sandbox) failed to add syscall %d, received libseccomp " "error %d", i, rc); return rc;

1 0

[tor/maint-0.2.9] Add a changes file.
by nickm＠torproject.org 11 Feb '18

11 Feb '18

commit 80bf270404a52c634a14f6aad594dec4e9ce1e12 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 16 14:07:58 2017 -0500 Add a changes file. --- changes/ticket24315 | 3 +++ 1 file changed, 3 insertions(+) diff --git a/changes/ticket24315 b/changes/ticket24315 new file mode 100644 index 000000000..df34dbf41 --- /dev/null +++ b/changes/ticket24315 @@ -0,0 +1,3 @@ + o Major features (linux seccomp2 sandbox): + - Update the sandbox rules so that they should now work correctly with + Glibc 2.26. Closes ticket 24315.

1 0

[tor/maint-0.2.9] Check the libc version to decide whether to allow openat.
by nickm＠torproject.org 11 Feb '18

11 Feb '18

commit 2d3904aba67e79e57db1814033b1df3f77336065 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 16 14:06:38 2017 -0500 Check the libc version to decide whether to allow openat. --- configure.ac | 2 ++ src/common/sandbox.c | 38 +++++++++++++++++++++++++++++++++++++- 2 files changed, 39 insertions(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac index f2c3f90ba..3ff819052 100644 --- a/configure.ac +++ b/configure.ac @@ -390,6 +390,7 @@ AC_CHECK_FUNCS( getrlimit \ gettimeofday \ gmtime_r \ + gnu_get_libc_version \ htonll \ inet_aton \ ioctl \ @@ -1011,6 +1012,7 @@ AC_CHECK_HEADERS([assert.h \ arpa/inet.h \ crt_externs.h \ execinfo.h \ + gnu/libc-version.h \ grp.h \ ifaddrs.h \ inttypes.h \ diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 417c1e305..d0ead2cae 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -56,6 +56,9 @@ #include <time.h> #include <poll.h> +#ifdef HAVE_GNU_LIBC_VERSION_H +#include <gnu/libc-version.h> +#endif #ifdef HAVE_LINUX_NETFILTER_IPV4_H #include <linux/netfilter_ipv4.h> #endif @@ -424,6 +427,37 @@ sb_mmap2(scmp_filter_ctx ctx, sandbox_cfg_t *filter) } #endif +#ifdef HAVE_GNU_LIBC_VERSION_H +#ifdef HAVE_GNU_GET_LIBC_VERSION +#define CHECK_LIBC_VERSION +#endif +#endif + +/* Return true if we think we're running with a libc that always uses + * openat on linux. */ +static int +libc_uses_openat_for_everything(void) +{ +#ifdef CHECK_LIBC_VERSION + const char *version = gnu_get_libc_version(); + if (version == NULL) + return 0; + + int major = -1; + int minor = -1; + + tor_sscanf(version, "%d.%d", &major, &minor); + if (major >= 3) + return 1; + else if (major == 2 && minor >= 26) + return 1; + else + return 0; +#else + return 0; +#endif +} + /** Allow a single file to be opened. If use_openat is true, * we're using a libc that remaps all the opens into openats. */ static int @@ -449,13 +483,15 @@ sb_open(scmp_filter_ctx ctx, sandbox_cfg_t *filter) int rc; sandbox_cfg_t *elem = NULL; + int use_openat = libc_uses_openat_for_everything(); + // for each dynamic parameter filters for (elem = filter; elem != NULL; elem = elem->next) { smp_param_t *param = elem->param; if (param != NULL && param->prot == 1 && param->syscall == SCMP_SYS(open)) { - rc = allow_file_open(ctx, 0 /* XXXX */, param->value); + rc = allow_file_open(ctx, use_openat, param->value); if (rc != 0) { log_err(LD_BUG,"(Sandbox) failed to add open syscall, received " "libseccomp error %d", rc);

1 0

[tor/maint-0.2.9] Merge branch 'ticket24315_029' into maint-0.2.9
by nickm＠torproject.org 11 Feb '18

11 Feb '18

commit 848ba26c188c43cb97a22d5911fceb3714a97272 Merge: 5dc785cee 80bf27040 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Feb 11 18:07:37 2018 -0500 Merge branch 'ticket24315_029' into maint-0.2.9 changes/ticket24315 | 3 +++ configure.ac | 2 ++ src/common/sandbox.c | 71 +++++++++++++++++++++++++++++++++++++++++++++++++--- 3 files changed, 72 insertions(+), 4 deletions(-)

1 0

[tor/maint-0.2.9] Don't treat a setrlimit failure as fatal.
by nickm＠torproject.org 11 Feb '18

11 Feb '18

commit 68ca6d2e1971372617f920e71a4a51e16900095e Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jan 4 13:20:37 2018 -0500 Don't treat a setrlimit failure as fatal. Fixes bug 21074; bugfix on 4689243242e2e12 in 0.0.9rc5 when we started doing setrlimit() in the first place. --- changes/bug21074_downgrade | 4 ++++ src/common/compat.c | 14 +++++++------- 2 files changed, 11 insertions(+), 7 deletions(-) diff --git a/changes/bug21074_downgrade b/changes/bug21074_downgrade new file mode 100644 index 000000000..c9f81bd13 --- /dev/null +++ b/changes/bug21074_downgrade @@ -0,0 +1,4 @@ + o Minor bugfixes: + - Don't exit the Tor process if setrlimit() fails to change the file + limit (which can happen sometimes on some versions of OSX). Fixes + bug 21074; bugfix on 0.0.9pre5. diff --git a/src/common/compat.c b/src/common/compat.c index e16dfb1d2..a88e9b514 100644 --- a/src/common/compat.c +++ b/src/common/compat.c @@ -1651,7 +1651,7 @@ get_max_sockets(void) * fail by returning -1 and max_out is untouched. * * If we are unable to set the limit value because of setrlimit() failing, - * return -1 and max_out is set to the current maximum value returned + * return 0 and max_out is set to the current maximum value returned * by getrlimit(). * * Otherwise, return 0 and store the maximum we found inside max_out @@ -1716,13 +1716,14 @@ set_max_file_descriptors(rlim_t limit, int *max_out) rlim.rlim_cur = rlim.rlim_max; if (setrlimit(RLIMIT_NOFILE, &rlim) != 0) { - int bad = 1; + int couldnt_set = 1; + const int setrlimit_errno = errno; #ifdef OPEN_MAX uint64_t try_limit = OPEN_MAX - ULIMIT_BUFFER; if (errno == EINVAL && try_limit < (uint64_t) rlim.rlim_cur) { /* On some platforms, OPEN_MAX is the real limit, and getrlimit() is * full of nasty lies. I'm looking at you, OSX 10.5.... */ - rlim.rlim_cur = try_limit; + rlim.rlim_cur = MIN(try_limit, rlim.rlim_cur); if (setrlimit(RLIMIT_NOFILE, &rlim) == 0) { if (rlim.rlim_cur < (rlim_t)limit) { log_warn(LD_CONFIG, "We are limited to %lu file descriptors by " @@ -1737,14 +1738,13 @@ set_max_file_descriptors(rlim_t limit, int *max_out) (unsigned long)try_limit, (unsigned long)OPEN_MAX, (unsigned long)rlim.rlim_max); } - bad = 0; + couldnt_set = 0; } } #endif /* OPEN_MAX */ - if (bad) { + if (couldnt_set) { log_warn(LD_CONFIG,"Couldn't set maximum number of file descriptors: %s", - strerror(errno)); - return -1; + strerror(setrlimit_errno)); } } /* leave some overhead for logs, etc, */

1 0

[tor/maint-0.2.9] Merge remote-tracking branch 'public/bug21074_029' into maint-0.2.9
by nickm＠torproject.org 11 Feb '18

11 Feb '18

commit 5dc785ceef465125f180f020991ec2c363bb8abc Merge: 320dac460 0bfd5a659 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Feb 11 16:51:53 2018 -0500 Merge remote-tracking branch 'public/bug21074_029' into maint-0.2.9 changes/bug21074_downgrade | 4 ++++ src/common/compat.c | 14 +++++++------- 2 files changed, 11 insertions(+), 7 deletions(-)

1 0