May 2021 - tor-commits - lists.torproject.org

[tor/release-0.4.6] Merge branch 'maint-0.4.5' into maint-0.4.6
by nickm＠torproject.org 07 May '21

07 May '21

commit e4f2b52debc727fc35806adc889227d8aaf975a8 Merge: 5acf18bfaa d85ef0d5e0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri May 7 13:08:25 2021 -0400 Merge branch 'maint-0.4.5' into maint-0.4.6 changes/ticket40382 | 6 ++++++ src/lib/sandbox/sandbox.c | 22 ++++++++++++++++++++++ 2 files changed, 28 insertions(+)

1 0

[tor/release-0.4.5] Merge branch 'ticket40382_045' into maint-0.4.5
by nickm＠torproject.org 07 May '21

07 May '21

commit d85ef0d5e042b2f8693d6a104b8c97d58d0ed5f6 Merge: 7c86f34340 f5acfe6723 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri May 7 13:08:14 2021 -0400 Merge branch 'ticket40382_045' into maint-0.4.5 changes/ticket40382 | 6 ++++++ src/lib/sandbox/sandbox.c | 22 ++++++++++++++++++++++ 2 files changed, 28 insertions(+)

1 0

[tor/release-0.4.6] Add a sandbox workaround for Glibc 2.33
by nickm＠torproject.org 07 May '21

07 May '21

commit f5acfe67238a331bf8a6e94715163949999f27e7 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri May 7 12:09:41 2021 -0400 Add a sandbox workaround for Glibc 2.33 This change permits the newfstatat() system call, and fixes issues 40382 (and 40381). This isn't a free change. From the commit: // Libc 2.33 uses this syscall to implement both fstat() and stat(). // // The trouble is that to implement fstat(fd, &st), it calls: // newfstatat(fs, "", &st, AT_EMPTY_PATH) // We can't detect this usage in particular, because "" is a pointer // we don't control. And we can't just look for AT_EMPTY_PATH, since // AT_EMPTY_PATH only has effect when the path string is empty. // // So our only solution seems to be allowing all fstatat calls, which // means that an attacker can stat() anything on the filesystem. That's // not a great solution, but I can't find a better one. --- changes/ticket40382 | 6 ++++++ src/lib/sandbox/sandbox.c | 22 ++++++++++++++++++++++ 2 files changed, 28 insertions(+) diff --git a/changes/ticket40382 b/changes/ticket40382 new file mode 100644 index 0000000000..5ac1b771b9 --- /dev/null +++ b/changes/ticket40382 @@ -0,0 +1,6 @@ + o Minor features (compatibility, Linux seccomp sandbox): + - Add a workaround to enable the Linux sandbox to work correctly + on systems running Glibc 2.33. These versions have started + using the fstatat() system call, which previously our sandbox did not + allow. + Closes ticket 40382; see the ticket for a discussion of tradeoffs. diff --git a/src/lib/sandbox/sandbox.c b/src/lib/sandbox/sandbox.c index 168dfd943c..fc90dbe062 100644 --- a/src/lib/sandbox/sandbox.c +++ b/src/lib/sandbox/sandbox.c @@ -1608,6 +1608,28 @@ add_noparam_filter(scmp_filter_ctx ctx) } } + if (is_libc_at_least(2, 33)) { +#ifdef __NR_newfstatat + // Libc 2.33 uses this syscall to implement both fstat() and stat(). + // + // The trouble is that to implement fstat(fd, &st), it calls: + // newfstatat(fs, "", &st, AT_EMPTY_PATH) + // We can't detect this usage in particular, because "" is a pointer + // we don't control. And we can't just look for AT_EMPTY_PATH, since + // AT_EMPTY_PATH only has effect when the path string is empty. + // + // So our only solution seems to be allowing all fstatat calls, which + // means that an attacker can stat() anything on the filesystem. That's + // not a great solution, but I can't find a better one. + rc = seccomp_rule_add_0(ctx, SCMP_ACT_ALLOW, SCMP_SYS(newfstatat)); + if (rc != 0) { + log_err(LD_BUG,"(Sandbox) failed to add newfstatat() syscall; " + "received libseccomp error %d", rc); + return rc; + } +#endif + } + return 0; }

1 0

[tor/release-0.4.6] Merge branch 'ticket40382_045' into maint-0.4.5
by nickm＠torproject.org 07 May '21

07 May '21

commit d85ef0d5e042b2f8693d6a104b8c97d58d0ed5f6 Merge: 7c86f34340 f5acfe6723 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri May 7 13:08:14 2021 -0400 Merge branch 'ticket40382_045' into maint-0.4.5 changes/ticket40382 | 6 ++++++ src/lib/sandbox/sandbox.c | 22 ++++++++++++++++++++++ 2 files changed, 28 insertions(+)

1 0

[tor/release-0.4.6] Merge branch 'maint-0.4.6' into release-0.4.6
by nickm＠torproject.org 07 May '21

07 May '21

commit dd8ed19e95974df5ebbf19bc2af389bf300525d8 Merge: 18acf43175 e4f2b52deb Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri May 7 13:08:25 2021 -0400 Merge branch 'maint-0.4.6' into release-0.4.6 changes/ticket40382 | 6 ++++++ src/lib/sandbox/sandbox.c | 22 ++++++++++++++++++++++ 2 files changed, 28 insertions(+)

1 0

[tor/maint-0.4.5] Add a sandbox workaround for Glibc 2.33
by nickm＠torproject.org 07 May '21

07 May '21

commit f5acfe67238a331bf8a6e94715163949999f27e7 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri May 7 12:09:41 2021 -0400 Add a sandbox workaround for Glibc 2.33 This change permits the newfstatat() system call, and fixes issues 40382 (and 40381). This isn't a free change. From the commit: // Libc 2.33 uses this syscall to implement both fstat() and stat(). // // The trouble is that to implement fstat(fd, &st), it calls: // newfstatat(fs, "", &st, AT_EMPTY_PATH) // We can't detect this usage in particular, because "" is a pointer // we don't control. And we can't just look for AT_EMPTY_PATH, since // AT_EMPTY_PATH only has effect when the path string is empty. // // So our only solution seems to be allowing all fstatat calls, which // means that an attacker can stat() anything on the filesystem. That's // not a great solution, but I can't find a better one. --- changes/ticket40382 | 6 ++++++ src/lib/sandbox/sandbox.c | 22 ++++++++++++++++++++++ 2 files changed, 28 insertions(+) diff --git a/changes/ticket40382 b/changes/ticket40382 new file mode 100644 index 0000000000..5ac1b771b9 --- /dev/null +++ b/changes/ticket40382 @@ -0,0 +1,6 @@ + o Minor features (compatibility, Linux seccomp sandbox): + - Add a workaround to enable the Linux sandbox to work correctly + on systems running Glibc 2.33. These versions have started + using the fstatat() system call, which previously our sandbox did not + allow. + Closes ticket 40382; see the ticket for a discussion of tradeoffs. diff --git a/src/lib/sandbox/sandbox.c b/src/lib/sandbox/sandbox.c index 168dfd943c..fc90dbe062 100644 --- a/src/lib/sandbox/sandbox.c +++ b/src/lib/sandbox/sandbox.c @@ -1608,6 +1608,28 @@ add_noparam_filter(scmp_filter_ctx ctx) } } + if (is_libc_at_least(2, 33)) { +#ifdef __NR_newfstatat + // Libc 2.33 uses this syscall to implement both fstat() and stat(). + // + // The trouble is that to implement fstat(fd, &st), it calls: + // newfstatat(fs, "", &st, AT_EMPTY_PATH) + // We can't detect this usage in particular, because "" is a pointer + // we don't control. And we can't just look for AT_EMPTY_PATH, since + // AT_EMPTY_PATH only has effect when the path string is empty. + // + // So our only solution seems to be allowing all fstatat calls, which + // means that an attacker can stat() anything on the filesystem. That's + // not a great solution, but I can't find a better one. + rc = seccomp_rule_add_0(ctx, SCMP_ACT_ALLOW, SCMP_SYS(newfstatat)); + if (rc != 0) { + log_err(LD_BUG,"(Sandbox) failed to add newfstatat() syscall; " + "received libseccomp error %d", rc); + return rc; + } +#endif + } + return 0; }

1 0

[tor/maint-0.4.5] Merge branch 'ticket40382_045' into maint-0.4.5
by nickm＠torproject.org 07 May '21

07 May '21

commit d85ef0d5e042b2f8693d6a104b8c97d58d0ed5f6 Merge: 7c86f34340 f5acfe6723 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri May 7 13:08:14 2021 -0400 Merge branch 'ticket40382_045' into maint-0.4.5 changes/ticket40382 | 6 ++++++ src/lib/sandbox/sandbox.c | 22 ++++++++++++++++++++++ 2 files changed, 28 insertions(+)

1 0

[tor/maint-0.3.5] Reindent a few lines to fix a GCC warning.
by nickm＠torproject.org 07 May '21

07 May '21

commit e2c1ac214c0ae77282709b50fb9fbdde50dd7a1f Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri May 7 10:39:20 2021 -0400 Reindent a few lines to fix a GCC warning. As of GCC 11.1.1, the compiler warns us about code like this: if (a) b; c; and that's a good thing: we wouldn't want to "goto fail". But we had an instance if this in circuituse.c, which was making our compilation sad. Fixes bug 40380; bugfix on 0.3.0.1-alpha. --- changes/bug40380 | 3 +++ src/core/or/circuituse.c | 8 ++++---- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/changes/bug40380 b/changes/bug40380 new file mode 100644 index 0000000000..24d2876b7d --- /dev/null +++ b/changes/bug40380 @@ -0,0 +1,3 @@ + o Minor bugfixes (compiler warnings): + - Fix an indentation problem that led to a warning from GCC 11.1.1. + Fixes bug 40380; bugfix on 0.3.0.1-alpha. diff --git a/src/core/or/circuituse.c b/src/core/or/circuituse.c index 7273be3510..efd69fb4a3 100644 --- a/src/core/or/circuituse.c +++ b/src/core/or/circuituse.c @@ -1315,10 +1315,10 @@ circuit_predict_and_launch_new(void) if (router_have_consensus_path() == CONSENSUS_PATH_INTERNAL) flags |= CIRCLAUNCH_IS_INTERNAL; - log_info(LD_CIRC, - "Have %d clean circs need another buildtime test circ.", num); - circuit_launch(CIRCUIT_PURPOSE_C_GENERAL, flags); - return; + log_info(LD_CIRC, + "Have %d clean circs need another buildtime test circ.", num); + circuit_launch(CIRCUIT_PURPOSE_C_GENERAL, flags); + return; } }

1 0

[tor/maint-0.4.4] Merge branch 'maint-0.3.5' into maint-0.4.4
by nickm＠torproject.org 07 May '21

07 May '21

commit 48dd87933dd1c592937ef62d20aeac8998edc0fb Merge: f68aeda549 e2c1ac214c Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri May 7 10:41:33 2021 -0400 Merge branch 'maint-0.3.5' into maint-0.4.4 changes/bug40380 | 3 +++ src/core/or/circuituse.c | 8 ++++---- 2 files changed, 7 insertions(+), 4 deletions(-)

1 0

[tor/maint-0.4.4] Reindent a few lines to fix a GCC warning.
by nickm＠torproject.org 07 May '21

07 May '21

commit e2c1ac214c0ae77282709b50fb9fbdde50dd7a1f Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri May 7 10:39:20 2021 -0400 Reindent a few lines to fix a GCC warning. As of GCC 11.1.1, the compiler warns us about code like this: if (a) b; c; and that's a good thing: we wouldn't want to "goto fail". But we had an instance if this in circuituse.c, which was making our compilation sad. Fixes bug 40380; bugfix on 0.3.0.1-alpha. --- changes/bug40380 | 3 +++ src/core/or/circuituse.c | 8 ++++---- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/changes/bug40380 b/changes/bug40380 new file mode 100644 index 0000000000..24d2876b7d --- /dev/null +++ b/changes/bug40380 @@ -0,0 +1,3 @@ + o Minor bugfixes (compiler warnings): + - Fix an indentation problem that led to a warning from GCC 11.1.1. + Fixes bug 40380; bugfix on 0.3.0.1-alpha. diff --git a/src/core/or/circuituse.c b/src/core/or/circuituse.c index 7273be3510..efd69fb4a3 100644 --- a/src/core/or/circuituse.c +++ b/src/core/or/circuituse.c @@ -1315,10 +1315,10 @@ circuit_predict_and_launch_new(void) if (router_have_consensus_path() == CONSENSUS_PATH_INTERNAL) flags |= CIRCLAUNCH_IS_INTERNAL; - log_info(LD_CIRC, - "Have %d clean circs need another buildtime test circ.", num); - circuit_launch(CIRCUIT_PURPOSE_C_GENERAL, flags); - return; + log_info(LD_CIRC, + "Have %d clean circs need another buildtime test circ.", num); + circuit_launch(CIRCUIT_PURPOSE_C_GENERAL, flags); + return; } }

1 0