September 2021 - tor-commits - lists.torproject.org

[torspec/main] Add Prop334: A Directory Authority Flag To Mark Relays As Middle-only
by dgoulet＠torproject.org 30 Sep '21

30 Sep '21

commit b0e26eac5f3224553b58efb1fde6c8d90dd8adbe Author: Neel Chauhan <neel(a)neelc.org> Date: Fri Sep 17 16:07:40 2021 -0700 Add Prop334: A Directory Authority Flag To Mark Relays As Middle-only --- proposals/334-middle-only-flag.txt | 115 +++++++++++++++++++++++++++++++++++++ 1 file changed, 115 insertions(+) diff --git a/proposals/334-middle-only-flag.txt b/proposals/334-middle-only-flag.txt new file mode 100644 index 0000000..ed5de42 --- /dev/null +++ b/proposals/334-middle-only-flag.txt @@ -0,0 +1,115 @@ +Filename: 334-middle-only-flag.txt +Title: A Directory Authority Flag To Mark Relays As Middle-only +Author: Neel Chauhan +Created: 2021-09-07 +Status: Open + +1. Introduction + + The Health Team often deals with a large number of relays with an incorrect + configuration (e.g. not all relays in MyFamily), or needs validation that + requires contacting the relay operator. It is desirable to put the said + relays in a less powerful position, such as a middle only flag that prevents + a relay from being used in more powerful positions like an entry guard or an + exit relay. [1] + +1.1. Motivation + + The proposed middle-only flag is needed by the Health Team to prevent + misconfigured relays from being used in positions capable of deanonymizing + users while the team evaluates the relay's risk to the network. An example + of this scenario is when a guard and exit relay run by the same operator + has an incomplete MyFamily, and the same operator's guard and exit are used + in a circuit. + + The reason why we won't play with the Guard and Exit flags or weights to + achieve the same goal is because even if we were to reduce the guard and + exit weights of a misconfigured relay, it could keep some users at risk of + deanonymization. Even a small fraction of users at risk of deanonymization + isn't something we should aim for. + + One case we could look out for is if all relays are exit relays (unlikely), + or if walking onions are working on the current Tor network. This proposal + should not affect those scenarios, but we should watch out for these cases. + +2. The MiddleOnly Flag + + We propose a consensus flag MiddleOnly. As mentioned earlier, relays will be + assigned this flag from the directory authorities. + + What this flag does is that a relay must not be used as an entry guard or + exit relay. This is to prevent issues with a misconfigured relay as described + in Section 1 (Introduction) while the Health Team assesses the risk with the + relay. + +3. Implementation details + + The MiddleOnly flag can be assigned to relays whose IP addresses and/or + fingerprints are configured at the directory authority level, similar to + how the BadExit flag currently works. In short, if a relay's IP is + designated as middle-only, it must assign the MiddleOnly flag, otherwise + we must not assign it. + + Relays which haven't gotten the Guard or Exit flags yet but have IP addresses + that aren't designated as middle-only in the dirauths must not get the + MiddleOnly flag. This is to allow new entry guards and exit relays to enter + the Tor network, while giving relay administrators flexibility to increase + and reduce bandwidth, or change their exit policy. + +3.1. Client Implementation + + Clients should interpret the MiddleOnly flag while parsing relay descriptors + to determine whether a relay is to be avoided for non-middle purposes. If + a client parses the MiddleOnly flag, it must not use MiddleOnly-designated + relays as entry guards or exit relays. + +3.2. MiddleOnly Relay Purposes + + If a relay has the MiddleOnly flag, we do not allow it to be used for the + following purposes: + + * Entry Guard + + * Directory Guard + + * Exit Relay + + The reason for this is to prevent a misconfigured relay from being used + in places where they may know about clients or destination traffic. This + is in case certain misconfigured relays are used to deanonymize clients. + + We could also bar a MiddleOnly relay from other purposes such as rendezvous + and fallback directory purposes. However, while more secure in theory, this + adds unnecessary complexity to the Tor design and has the possibility of + breaking clients that aren't MiddleOnly-aware [2]. + +4. Consensus Considerations + +4.1. Consensus Methods + + We propose a new consensus method 32, which is to only use this flag if and + when all authorities understand the flag and agree on it. This is because the + MiddleOnly flag impacts path selection for clients. + +4.2. Consensus Requirements + + The MiddleOnly flag would work like most other consensus flags where a + majority of dirauths have to assign a relay the flag in order for a relay + to have the MiddleOnly flag. + + Another approach is to make it that only one dirauth is needed to give + relays this flag, however it would put too much power in the hands of a + single directory authority servre [3]. + +5. Acknowledgements + + Thank you so much to nusenu, s7r, David Goulet, and Roger Dingledine for your + suggestions to Prop334. My proposal wouldn't be what it is without you. + +6. Citations + + [1] - https://gitlab.torproject.org/tpo/core/tor/-/issues/40448 + + [2] - https://lists.torproject.org/pipermail/tor-dev/2021-September/014627.html + + [3] - https://lists.torproject.org/pipermail/tor-dev/2021-September/014630.html

1 0

[torspec/main] proposals: Run reindex.py
by dgoulet＠torproject.org 30 Sep '21

30 Sep '21

commit 76aee658c5a0dbb9cef2ad07b6d0f137735a0930 Author: David Goulet <dgoulet(a)torproject.org> Date: Thu Sep 30 08:34:05 2021 -0400 proposals: Run reindex.py Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- proposals/000-index.txt | 4 ++++ proposals/BY_INDEX.md | 2 ++ proposals/README.md | 2 ++ 3 files changed, 8 insertions(+) diff --git a/proposals/000-index.txt b/proposals/000-index.txt index adfe0ba..cb9a9fa 100644 --- a/proposals/000-index.txt +++ b/proposals/000-index.txt @@ -253,6 +253,8 @@ Proposals by number: 330 Modernizing authority contact entries [OPEN] 331 Res tokens: Anonymous Credentials for Onion Service DoS Resilience [DRAFT] 332 Ntor protocol with extra data, version 3 [OPEN] +333 Vanguards lite [DRAFT] +334 A Directory Authority Flag To Mark Relays As Middle-only [OPEN] Proposals by status: @@ -265,6 +267,7 @@ Proposals by status: 328 Make Relays Report When They Are Overloaded 329 Overcoming Tor's Bottlenecks with Traffic Splitting 331 Res tokens: Anonymous Credentials for Onion Service DoS Resilience + 333 Vanguards lite NEEDS-REVISION: 212 Increase Acceptable Consensus Age [for 0.2.4.x+] 219 Support for full DNS and DNSSEC resolution in Tor [for 0.2.5.x] @@ -296,6 +299,7 @@ Proposals by status: 326 The "tor-relay" Well-Known Resource Identifier 330 Modernizing authority contact entries 332 Ntor protocol with extra data, version 3 + 334 A Directory Authority Flag To Mark Relays As Middle-only ACCEPTED: 265 Load Balancing with Overhead Parameters [for 0.2.9.x] 275 Stop including meaningful "published" time in microdescriptor consensus [for 0.3.1.x-alpha] diff --git a/proposals/BY_INDEX.md b/proposals/BY_INDEX.md index 2279bd2..9fa8a78 100644 --- a/proposals/BY_INDEX.md +++ b/proposals/BY_INDEX.md @@ -250,4 +250,6 @@ Below are a list of proposals sorted by their proposal number. See * [`330-authority-contact.md`](/proposals/330-authority-contact.md): Modernizing authority contact entries [OPEN] * [`331-res-tokens-for-anti-dos.md`](/proposals/331-res-tokens-for-anti-dos.md): Res tokens: Anonymous Credentials for Onion Service DoS Resilience [DRAFT] * [`332-ntor-v3-with-extra-data.md`](/proposals/332-ntor-v3-with-extra-data.md): Ntor protocol with extra data, version 3 [OPEN] +* [`333-vanguards-lite.md`](/proposals/333-vanguards-lite.md): Vanguards lite [DRAFT] +* [`334-middle-only-flag.txt`](/proposals/334-middle-only-flag.txt): A Directory Authority Flag To Mark Relays As Middle-only [OPEN] diff --git a/proposals/README.md b/proposals/README.md index ba73953..3e3645a 100644 --- a/proposals/README.md +++ b/proposals/README.md @@ -41,6 +41,7 @@ for discussion. * [`326-tor-relay-well-known-uri-rfc8615.md`](/proposals/326-tor-relay-well-known-uri-rfc8615.md): The "tor-relay" Well-Known Resource Identifier * [`330-authority-contact.md`](/proposals/330-authority-contact.md): Modernizing authority contact entries * [`332-ntor-v3-with-extra-data.md`](/proposals/332-ntor-v3-with-extra-data.md): Ntor protocol with extra data, version 3 +* [`334-middle-only-flag.txt`](/proposals/334-middle-only-flag.txt): A Directory Authority Flag To Mark Relays As Middle-only ## ACCEPTED proposals: slated for implementation @@ -111,6 +112,7 @@ discussion. * [`328-relay-overload-report.md`](/proposals/328-relay-overload-report.md): Make Relays Report When They Are Overloaded * [`329-traffic-splitting.txt`](/proposals/329-traffic-splitting.txt): Overcoming Tor's Bottlenecks with Traffic Splitting * [`331-res-tokens-for-anti-dos.md`](/proposals/331-res-tokens-for-anti-dos.md): Res tokens: Anonymous Credentials for Onion Service DoS Resilience +* [`333-vanguards-lite.md`](/proposals/333-vanguards-lite.md): Vanguards lite ## NEEDS-REVISION proposals: ideas that we can't implement as-is

1 0

[torspec/main] Merge branch 'tor-gitlab/mr/46'
by dgoulet＠torproject.org 30 Sep '21

30 Sep '21

commit 8709708450e45aa2989dbb57ea223be25770d6b4 Merge: e06b912 b0e26ea Author: David Goulet <dgoulet(a)torproject.org> Date: Thu Sep 30 08:33:39 2021 -0400 Merge branch 'tor-gitlab/mr/46' proposals/334-middle-only-flag.txt | 115 +++++++++++++++++++++++++++++++++++++ 1 file changed, 115 insertions(+)

1 0

[translation/tbmanual-contentspot] https://gitweb.torproject.org/translation.git/commit/?h=tbmanual-contentspot
by translation＠torproject.org 30 Sep '21

30 Sep '21

commit 0cd8033f3ebe78c629b45c7d9a0c78ba80b9c589 Author: Translation commit bot <translation(a)torproject.org> Date: Thu Sep 30 04:46:48 2021 +0000 https://gitweb.torproject.org/translation.git/commit/?h=tbmanual-contentspot --- contents+id.po | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/contents+id.po b/contents+id.po index 8401a0b2cd..b40dfb520f 100644 --- a/contents+id.po +++ b/contents+id.po @@ -11,6 +11,7 @@ # Evanna Audrey <evanna.n.audrey(a)gmail.com>, 2021 # erinm, 2021 # Emma Peel, 2021 +# Sidiq Pangestu <sani21bimo(a)gmail.com>, 2021 # msgid "" msgstr "" @@ -18,7 +19,7 @@ msgstr "" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2021-09-03 10:01+CET\n" "PO-Revision-Date: 2018-11-14 12:31+0000\n" -"Last-Translator: Emma Peel, 2021\n" +"Last-Translator: Sidiq Pangestu <sani21bimo(a)gmail.com>, 2021\n" "Language-Team: Indonesian (https://www.transifex.com/otf/teams/1519/id/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -1931,6 +1932,8 @@ msgid "" "When you are prompted to update Tor Browser, click on hamburger menu (main " "menu), then select “Restart to update Tor browser”." msgstr "" +"Ketika Anda diminta untuk memperbarui Tor Browser, klik menu hamburger (menu" +" utama), kemudian pilih \"Mulai ulang untuk Memperbarui Tor Browser\"" #: https//tb-manual.torproject.org/updating/ #: (content/updating/contents+en.lrtopic.body)

1 0

[tor/main] configure.ac: Define ENABLE_FRAGILE_HARDENING macro
by nickm＠torproject.org 29 Sep '21

29 Sep '21

commit 352677556e14480753f75e8abe1f584f1580f1b2 Author: Simon South <simon(a)simonsouth.net> Date: Wed Sep 22 14:42:45 2021 -0400 configure.ac: Define ENABLE_FRAGILE_HARDENING macro Allow conditional compilation based on whether the "--enable-fragile-hardening" configure option was specified. --- configure.ac | 1 + 1 file changed, 1 insertion(+) diff --git a/configure.ac b/configure.ac index 23ba4b0d2d..b4617a4003 100644 --- a/configure.ac +++ b/configure.ac @@ -233,6 +233,7 @@ AC_ARG_ENABLE(fragile-hardening, AS_HELP_STRING(--enable-fragile-hardening, [enable more fragile and expensive compiler hardening; makes Tor slower])) if test "x$enable_expensive_hardening" = "xyes" || test "x$enable_fragile_hardening" = "xyes"; then fragile_hardening="yes" + AC_DEFINE(ENABLE_FRAGILE_HARDENING, 1, [Defined if we're building with additional, fragile and expensive compiler hardening]) AC_DEFINE(DEBUG_SMARTLIST, 1, [Enable smartlist debugging]) fi

1 0

[tor/main] test: Add sandbox unit tests
by nickm＠torproject.org 29 Sep '21

29 Sep '21

commit 1a10948260d915d4982415e37dd6495bca9ef545 Author: Simon South <simon(a)simonsouth.net> Date: Thu Sep 2 11:04:23 2021 -0400 test: Add sandbox unit tests --- changes/issue16803 | 2 + src/test/include.am | 1 + src/test/test.c | 4 + src/test/test.h | 1 + src/test/test_sandbox.c | 348 ++++++++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 356 insertions(+) diff --git a/changes/issue16803 b/changes/issue16803 new file mode 100644 index 0000000000..7d0dd833e2 --- /dev/null +++ b/changes/issue16803 @@ -0,0 +1,2 @@ + o Testing: + - Add unit tests for the Linux seccomp sandbox. Resolves issue 16803. diff --git a/src/test/include.am b/src/test/include.am index 0dc1630044..fb2c03ceb9 100644 --- a/src/test/include.am +++ b/src/test/include.am @@ -231,6 +231,7 @@ src_test_test_SOURCES += \ src/test/test_routerkeys.c \ src/test/test_routerlist.c \ src/test/test_routerset.c \ + src/test/test_sandbox.c \ src/test/test_scheduler.c \ src/test/test_sendme.c \ src/test/test_shared_random.c \ diff --git a/src/test/test.c b/src/test/test.c index 0aa1353ec2..c38d78da30 100644 --- a/src/test/test.c +++ b/src/test/test.c @@ -52,6 +52,7 @@ #include "core/crypto/onion_fast.h" #include "core/crypto/onion_tap.h" #include "core/or/policies.h" +#include "lib/sandbox/sandbox.h" #include "app/config/statefile.h" #include "lib/crypt_ops/crypto_curve25519.h" #include "feature/nodelist/networkstatus.h" @@ -732,6 +733,9 @@ struct testgroup_t testgroups[] = { { "routerkeys/", routerkeys_tests }, { "routerlist/", routerlist_tests }, { "routerset/" , routerset_tests }, +#ifdef USE_LIBSECCOMP + { "sandbox/" , sandbox_tests }, +#endif { "scheduler/", scheduler_tests }, { "sendme/", sendme_tests }, { "shared-random/", sr_tests }, diff --git a/src/test/test.h b/src/test/test.h index 0a22043acc..e17bce427c 100644 --- a/src/test/test.h +++ b/src/test/test.h @@ -184,6 +184,7 @@ extern struct testcase_t router_tests[]; extern struct testcase_t routerkeys_tests[]; extern struct testcase_t routerlist_tests[]; extern struct testcase_t routerset_tests[]; +extern struct testcase_t sandbox_tests[]; extern struct testcase_t scheduler_tests[]; extern struct testcase_t sendme_tests[]; extern struct testcase_t socks_tests[]; diff --git a/src/test/test_sandbox.c b/src/test/test_sandbox.c new file mode 100644 index 0000000000..e5064c58ec --- /dev/null +++ b/src/test/test_sandbox.c @@ -0,0 +1,348 @@ +/* Copyright (c) 2021, The Tor Project, Inc. */ +/* See LICENSE for licensing information */ + +#ifndef _LARGEFILE64_SOURCE +/** + * Temporarily required for O_LARGEFILE flag. Needs to be removed + * with the libevent fix. + */ +#define _LARGEFILE64_SOURCE +#endif /* !defined(_LARGEFILE64_SOURCE) */ + +#include "orconfig.h" + +#include "lib/sandbox/sandbox.h" + +#ifdef USE_LIBSECCOMP + +#include <dirent.h> +#ifdef HAVE_FCNTL_H +#include <fcntl.h> +#endif +#ifdef HAVE_SYS_STAT_H +#include <sys/stat.h> +#endif +#ifdef HAVE_UNISTD_H +#include <unistd.h> +#endif + +#include "core/or/or.h" + +#include "test/test.h" +#include "test/log_test_helpers.h" + +typedef struct { + sandbox_cfg_t *cfg; + + char *file_ops_allowed; + char *file_ops_blocked; + + char *file_rename_target_allowed; + + char *dir_ops_allowed; + char *dir_ops_blocked; +} sandbox_data_t; + +/* All tests are skipped when coverage support is enabled (see further below) + * as the sandbox interferes with the use of gcov. Prevent a compiler warning + * by omitting these definitions in that case. */ +#ifndef ENABLE_COVERAGE +static void * +setup_sandbox(const struct testcase_t *testcase) +{ + sandbox_data_t *data = tor_malloc_zero(sizeof(*data)); + + (void)testcase; + + /* Establish common file and directory names within the test suite's + * temporary directory. */ + data->file_ops_allowed = tor_strdup(get_fname("file_ops_allowed")); + data->file_ops_blocked = tor_strdup(get_fname("file_ops_blocked")); + + data->file_rename_target_allowed = + tor_strdup(get_fname("file_rename_target_allowed")); + + data->dir_ops_allowed = tor_strdup(get_fname("dir_ops_allowed")); + data->dir_ops_blocked = tor_strdup(get_fname("dir_ops_blocked")); + + /* Create the corresponding filesystem objects. */ + creat(data->file_ops_allowed, S_IRWXU); + creat(data->file_ops_blocked, S_IRWXU); + mkdir(data->dir_ops_allowed, S_IRWXU); + mkdir(data->dir_ops_blocked, S_IRWXU); + + /* Create the sandbox configuration. */ + data->cfg = sandbox_cfg_new(); + + sandbox_cfg_allow_open_filename(&data->cfg, + tor_strdup(data->file_ops_allowed)); + sandbox_cfg_allow_open_filename(&data->cfg, + tor_strdup(data->dir_ops_allowed)); + + sandbox_cfg_allow_chmod_filename(&data->cfg, + tor_strdup(data->file_ops_allowed)); + sandbox_cfg_allow_chmod_filename(&data->cfg, + tor_strdup(data->dir_ops_allowed)); + sandbox_cfg_allow_chown_filename(&data->cfg, + tor_strdup(data->file_ops_allowed)); + sandbox_cfg_allow_chown_filename(&data->cfg, + tor_strdup(data->dir_ops_allowed)); + + sandbox_cfg_allow_rename(&data->cfg, tor_strdup(data->file_ops_allowed), + tor_strdup(data->file_rename_target_allowed)); + + sandbox_cfg_allow_openat_filename(&data->cfg, + tor_strdup(data->dir_ops_allowed)); + + sandbox_cfg_allow_opendir_dirname(&data->cfg, + tor_strdup(data->dir_ops_allowed)); + + sandbox_cfg_allow_stat_filename(&data->cfg, + tor_strdup(data->file_ops_allowed)); + sandbox_cfg_allow_stat_filename(&data->cfg, + tor_strdup(data->dir_ops_allowed)); + + /* Activate the sandbox, which will remain in effect until the process + * terminates. */ + sandbox_init(data->cfg); + + return data; +} + +static int +cleanup_sandbox(const struct testcase_t *testcase, void *data_) +{ + sandbox_data_t *data = data_; + + (void)testcase; + + tor_free(data->dir_ops_blocked); + tor_free(data->dir_ops_allowed); + tor_free(data->file_rename_target_allowed); + tor_free(data->file_ops_blocked); + tor_free(data->file_ops_allowed); + + tor_free(data); + + return 1; +} + +static const struct testcase_setup_t sandboxed_testcase_setup = { + .setup_fn = setup_sandbox, + .cleanup_fn = cleanup_sandbox +}; +#endif /* !defined(ENABLE_COVERAGE) */ + +static void +test_sandbox_is_active(void *ignored) +{ + (void)ignored; + + tt_assert(!sandbox_is_active()); + + sandbox_init(sandbox_cfg_new()); + tt_assert(sandbox_is_active()); + + done: + (void)0; +} + +static void +test_sandbox_open_filename(void *arg) +{ + sandbox_data_t *data = arg; + int fd, errsv; + + fd = open(sandbox_intern_string(data->file_ops_allowed), O_RDONLY); + if (fd == -1) + tt_abort_perror("open"); + close(fd); + + /* It might be nice to use sandbox_intern_string() in the line below as well + * (and likewise in the test cases that follow) but this would require + * capturing the warning message it logs, and the mechanism for doing so + * relies on system calls that are normally blocked by the sandbox and may + * vary across architectures. */ + fd = open(data->file_ops_blocked, O_RDONLY); + errsv = errno; + tt_int_op(fd, OP_EQ, -1); + tt_int_op(errsv, OP_EQ, EPERM); + + done: + if (fd >= 0) + close(fd); +} + +static void +test_sandbox_chmod_filename(void *arg) +{ + sandbox_data_t *data = arg; + int rc, errsv; + + if (chmod(sandbox_intern_string(data->file_ops_allowed), + S_IRUSR | S_IWUSR) != 0) + tt_abort_perror("chmod"); + + rc = chmod(data->file_ops_blocked, S_IRUSR | S_IWUSR); + errsv = errno; + tt_int_op(rc, OP_EQ, -1); + tt_int_op(errsv, OP_EQ, EPERM); + + done: + (void)0; +} + +static void +test_sandbox_chown_filename(void *arg) +{ + sandbox_data_t *data = arg; + int rc, errsv; + + if (chown(sandbox_intern_string(data->file_ops_allowed), -1, -1) != 0) + tt_abort_perror("chown"); + + rc = chown(data->file_ops_blocked, -1, -1); + errsv = errno; + tt_int_op(rc, OP_EQ, -1); + tt_int_op(errsv, OP_EQ, EPERM); + + done: + (void)0; +} + +static void +test_sandbox_rename_filename(void *arg) +{ + sandbox_data_t *data = arg; + const char *fname_old = sandbox_intern_string(data->file_ops_allowed), + *fname_new = sandbox_intern_string(data->file_rename_target_allowed); + int rc, errsv; + + if (rename(fname_old, fname_new) != 0) + tt_abort_perror("rename"); + + rc = rename(fname_new, fname_old); + errsv = errno; + tt_int_op(rc, OP_EQ, -1); + tt_int_op(errsv, OP_EQ, EPERM); + + done: + (void)0; +} + +static void +test_sandbox_openat_filename(void *arg) +{ + sandbox_data_t *data = arg; + int flags = O_RDONLY | O_NONBLOCK | O_LARGEFILE | O_DIRECTORY | O_CLOEXEC; + int fd, errsv; + + fd = openat(AT_FDCWD, sandbox_intern_string(data->dir_ops_allowed), flags); + if (fd < 0) + tt_abort_perror("openat"); + close(fd); + + fd = openat(AT_FDCWD, data->dir_ops_blocked, flags); + errsv = errno; + tt_int_op(fd, OP_EQ, -1); + tt_int_op(errsv, OP_EQ, EPERM); + + done: + if (fd >= 0) + close(fd); +} + +static void +test_sandbox_opendir_dirname(void *arg) +{ + sandbox_data_t *data = arg; + DIR *dir; + int errsv; + + dir = opendir(sandbox_intern_string(data->dir_ops_allowed)); + if (dir == NULL) + tt_abort_perror("opendir"); + closedir(dir); + + dir = opendir(data->dir_ops_blocked); + errsv = errno; + tt_ptr_op(dir, OP_EQ, NULL); + tt_int_op(errsv, OP_EQ, EPERM); + + done: + if (dir) + closedir(dir); +} + +static void +test_sandbox_stat_filename(void *arg) +{ + sandbox_data_t *data = arg; + struct stat st; + + if (stat(sandbox_intern_string(data->file_ops_allowed), &st) != 0) + tt_abort_perror("stat"); + + int rc = stat(data->file_ops_blocked, &st); + int errsv = errno; + tt_int_op(rc, OP_EQ, -1); + tt_int_op(errsv, OP_EQ, EPERM); + + done: + (void)0; +} + +#define SANDBOX_TEST_SKIPPED(name) \ + { #name, test_sandbox_ ## name, TT_SKIP, NULL, NULL } + +/* Skip all tests when coverage support is enabled, as the sandbox interferes + * with gcov and prevents it from producing any results. */ +#ifdef ENABLE_COVERAGE +#define SANDBOX_TEST(name, flags) SANDBOX_TEST_SKIPPED(name) +#define SANDBOX_TEST_IN_SANDBOX(name) SANDBOX_TEST_SKIPPED(name) +#else +#define SANDBOX_TEST(name, flags) \ + { #name, test_sandbox_ ## name, flags, NULL, NULL } +#define SANDBOX_TEST_IN_SANDBOX(name) \ + { #name, test_sandbox_ ## name, TT_FORK, &sandboxed_testcase_setup, NULL } +#endif /* defined(ENABLE_COVERAGE) */ + +struct testcase_t sandbox_tests[] = { + SANDBOX_TEST(is_active, TT_FORK), + +/* When Tor is built with fragile compiler-hardening the sandbox is unable to + * filter requests to open files or directories (on systems where glibc uses + * the "open" system call to provide this functionality), as doing so would + * interfere with the address sanitizer as it retrieves information about the + * running process via the filesystem. Skip these tests in that case as the + * corresponding functions are likely to have no effect and this will cause the + * tests to fail. */ +#ifdef ENABLE_FRAGILE_HARDENING + SANDBOX_TEST_SKIPPED(open_filename), + SANDBOX_TEST_SKIPPED(opendir_dirname), +#else + SANDBOX_TEST_IN_SANDBOX(open_filename), + SANDBOX_TEST_IN_SANDBOX(opendir_dirname), +#endif /* defined(ENABLE_FRAGILE_HARDENING) */ + + SANDBOX_TEST_IN_SANDBOX(openat_filename), + SANDBOX_TEST_IN_SANDBOX(chmod_filename), + SANDBOX_TEST_IN_SANDBOX(chown_filename), + SANDBOX_TEST_IN_SANDBOX(rename_filename), + +/* Currently the sandbox is unable to filter stat() calls on systems where + * glibc implements this function using the legacy "stat" system call, or where + * glibc version 2.33 or later is in use and the newer "newfstatat" syscall is + * available. + * + * Skip testing sandbox_cfg_allow_stat_filename() if it seems the likely the + * function will have no effect and the test will therefore not succeed. */ +#if !defined(__NR_newfstatat) && (!defined(__NR_stat) || defined(__NR_stat64)) + SANDBOX_TEST_IN_SANDBOX(stat_filename), +#else + SANDBOX_TEST_SKIPPED(stat_filename), +#endif + END_OF_TESTCASES +}; + +#endif /* defined(USE_SECCOMP) */

1 0

[tor/main] sandbox: Allow use with fragile hardening
by nickm＠torproject.org 29 Sep '21

29 Sep '21

commit fbf2e7e9218b8e0ffabcd59fab2322d7c2c7178c Author: Simon South <simon(a)simonsouth.net> Date: Fri Sep 24 14:08:58 2021 -0400 sandbox: Allow use with fragile hardening When building with --enable-fragile-hardening, add or relax Linux seccomp rules to allow AddressSanitizer to execute normally if the process terminates with the sandbox active. Further resolves issue 11477. --- changes/issue11477 | 8 +++++ src/app/main/main.c | 7 +++++ src/lib/sandbox/sandbox.c | 75 +++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 90 insertions(+) diff --git a/changes/issue11477 b/changes/issue11477 new file mode 100644 index 0000000000..bb5d9e4099 --- /dev/null +++ b/changes/issue11477 @@ -0,0 +1,8 @@ + o Minor bugfixes (fragile-hardening, sandbox): + - When building with --enable-fragile-hardening, add or relax Linux + seccomp rules to allow AddressSanitizer to execute normally if the + process terminates with the sandbox active. This has the side + effect of disabling the filtering of file- and directory-open + requests on most systems and dilutes the effectiveness of the + sandbox overall, as a wider range of system calls must be + permitted. Fixes bug 11477; bugfix on 0.2.5.4-alpha. diff --git a/src/app/main/main.c b/src/app/main/main.c index 89564490e6..0959b0db71 100644 --- a/src/app/main/main.c +++ b/src/app/main/main.c @@ -1343,6 +1343,13 @@ tor_run_main(const tor_main_configuration_t *tor_cfg) pubsub_connect(); if (get_options()->Sandbox && get_options()->command == CMD_RUN_TOR) { +#ifdef ENABLE_FRAGILE_HARDENING + log_warn(LD_CONFIG, "Sandbox is enabled but this Tor was built using " + "fragile compiler hardening. The sandbox may be unable to filter " + "requests to open files and directories and its overall " + "effectiveness will be reduced."); +#endif + sandbox_cfg_t* cfg = sandbox_init_filter(); if (sandbox_init(cfg)) { diff --git a/src/lib/sandbox/sandbox.c b/src/lib/sandbox/sandbox.c index 02222e5a1c..a78e4a7ac7 100644 --- a/src/lib/sandbox/sandbox.c +++ b/src/lib/sandbox/sandbox.c @@ -58,6 +58,10 @@ #include <linux/futex.h> #include <sys/file.h> +#ifdef ENABLE_FRAGILE_HARDENING +#include <sys/ptrace.h> +#endif + #include <stdarg.h> #include <seccomp.h> #include <signal.h> @@ -191,6 +195,9 @@ static int filter_nopar_gen[] = { SCMP_SYS(getgid32), #endif SCMP_SYS(getpid), +#ifdef ENABLE_FRAGILE_HARDENING + SCMP_SYS(getppid), +#endif #ifdef __NR_getrlimit SCMP_SYS(getrlimit), #endif @@ -532,6 +539,24 @@ sb_open(scmp_filter_ctx ctx, sandbox_cfg_t *filter) int use_openat = libc_uses_openat_for_open(); +#ifdef ENABLE_FRAGILE_HARDENING + /* AddressSanitizer uses the "open" syscall to access information about the + * running process via the filesystem, so that call must be allowed without + * restriction or the sanitizer will be unable to execute normally when the + * process terminates. */ + rc = seccomp_rule_add_0(ctx, SCMP_ACT_ALLOW, SCMP_SYS(open)); + if (rc != 0) { + log_err(LD_BUG,"(Sandbox) failed to add open syscall, received " + "libseccomp error %d", rc); + return rc; + } + + /* If glibc also uses only the "open" syscall to open files on this system + * there is no need to consider any additional rules. */ + if (!use_openat) + return 0; +#endif + // for each dynamic parameter filters for (elem = filter; elem != NULL; elem = elem->next) { smp_param_t *param = elem->param; @@ -687,6 +712,34 @@ sb_opendir(scmp_filter_ctx ctx, sandbox_cfg_t *filter) return 0; } +#ifdef ENABLE_FRAGILE_HARDENING +/** + * Function responsible for setting up the ptrace syscall for + * the seccomp filter sandbox. + */ +static int +sb_ptrace(scmp_filter_ctx ctx, sandbox_cfg_t *filter) +{ + int rc; + pid_t pid = getpid(); + (void) filter; + + rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(ptrace), + SCMP_CMP(0, SCMP_CMP_EQ, PTRACE_ATTACH), + SCMP_CMP(1, SCMP_CMP_EQ, pid)); + if (rc) + return rc; + + rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(ptrace), + SCMP_CMP(0, SCMP_CMP_EQ, PTRACE_GETREGS), + SCMP_CMP(1, SCMP_CMP_EQ, pid)); + if (rc) + return rc; + + return 0; +} +#endif + /** * Function responsible for setting up the socket syscall for * the seccomp filter sandbox. @@ -1009,6 +1062,18 @@ sb_prctl(scmp_filter_ctx ctx, sandbox_cfg_t *filter) int rc = 0; (void) filter; +#ifdef ENABLE_FRAGILE_HARDENING + rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(prctl), + SCMP_CMP(0, SCMP_CMP_EQ, PR_GET_DUMPABLE)); + if (rc) + return rc; + + rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(prctl), + SCMP_CMP(0, SCMP_CMP_EQ, PR_SET_PTRACER)); + if (rc) + return rc; +#endif + rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(prctl), SCMP_CMP(0, SCMP_CMP_EQ, PR_SET_DUMPABLE)); if (rc) @@ -1053,6 +1118,13 @@ sb_rt_sigprocmask(scmp_filter_ctx ctx, sandbox_cfg_t *filter) int rc = 0; (void) filter; +#ifdef ENABLE_FRAGILE_HARDENING + rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(rt_sigprocmask), + SCMP_CMP(0, SCMP_CMP_EQ, SIG_BLOCK)); + if (rc) + return rc; +#endif + rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(rt_sigprocmask), SCMP_CMP(0, SCMP_CMP_EQ, SIG_UNBLOCK)); if (rc) @@ -1202,6 +1274,9 @@ static sandbox_filter_func_t filter_func[] = { sb_open, sb_openat, sb_opendir, +#ifdef ENABLE_FRAGILE_HARDENING + sb_ptrace, +#endif sb_rename, #ifdef __NR_fcntl64 sb_fcntl64,

1 0

[tor/main] configure.ac: Define ENABLE_COVERAGE macro
by nickm＠torproject.org 29 Sep '21

29 Sep '21

commit 3bc3a108955c7b25a13808a2cfefcc77d2364cf4 Author: Simon South <simon(a)simonsouth.net> Date: Thu Sep 23 09:21:13 2021 -0400 configure.ac: Define ENABLE_COVERAGE macro Allow conditional compilation based on whether the "--enable-coverage" configure option was specified. --- configure.ac | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/configure.ac b/configure.ac index b4617a4003..f010c547b7 100644 --- a/configure.ac +++ b/configure.ac @@ -119,6 +119,11 @@ AM_CONDITIONAL(USE_RUST, test "x$enable_rust" = "xyes") AM_CONDITIONAL(USE_NSS, test "x$enable_nss" = "xyes") AM_CONDITIONAL(USE_OPENSSL, test "x$enable_nss" != "xyes") +if test "x$enable_coverage" = "xyes"; then + AC_DEFINE(ENABLE_COVERAGE, 1, + [Defined if coverage support is enabled for the unit tests]) +fi + if test "x$enable_nss" = "xyes"; then AC_DEFINE(ENABLE_NSS, 1, [Defined if we're building with NSS.])

1 0

[translation/communitytpo-contentspot] https://gitweb.torproject.org/translation.git/commit/?h=communitytpo-contentspot
by translation＠torproject.org 29 Sep '21

29 Sep '21

commit 3fb349cde7fdd93672dea29a4eedc8a16003d740 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Sep 29 20:45:22 2021 +0000 https://gitweb.torproject.org/translation.git/commit/?h=communitytpo-conten… --- contents+ro.po | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/contents+ro.po b/contents+ro.po index 1b88d33f1d..90483ef7ca 100644 --- a/contents+ro.po +++ b/contents+ro.po @@ -10247,6 +10247,11 @@ msgid "" "whom you're going to converse knows nothing about Tor. Assume this same " "person isn't going to trust anything you say." msgstr "" +"* Citiți [Prezentare generală Tor] " +"(https://2019.www.torproject.org/about/overview.html.en) Fiți pregătit să " +"rezumați și să răspundeți la întrebări de bază. Să presupunem că persoana cu" +" care urmează să conversați nu știe nimic despre Tor. Să presupunem că " +"aceeași persoană nu va avea încredere în nimic din ceea ce spui." #: https//community.torproject.org/relay/community-resources/tor-abuse-templates/ #: (content/relay/community-resources/tor-abuse-templates/contents+en.lrpage.body) @@ -13238,6 +13243,8 @@ msgid "" "| [Tailored VPS](http://tailoredvps.com/) | - | Yes | Yes | Yes(?) | - | - " "|" msgstr "" +"| [VPS personalizat] (http://tailoredvps.com/) | - | Da | Da | Da (?) | - | " +"- |" #: https//community.torproject.org/relay/community-resources/good-bad-isps/ #: (content/relay/community-resources/good-bad-isps/contents+en.lrpage.body)

1 0

[translation/communitytpo-contentspot] https://gitweb.torproject.org/translation.git/commit/?h=communitytpo-contentspot
by translation＠torproject.org 29 Sep '21

29 Sep '21

commit 6ef9f4dd23b2a029b5dc55d146f502d4495c686c Author: Translation commit bot <translation(a)torproject.org> Date: Wed Sep 29 20:15:21 2021 +0000 https://gitweb.torproject.org/translation.git/commit/?h=communitytpo-conten… --- contents+ro.po | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/contents+ro.po b/contents+ro.po index f57338c64a..1b88d33f1d 100644 --- a/contents+ro.po +++ b/contents+ro.po @@ -10,6 +10,7 @@ # Cristina Lupu <cristina(a)cji.ro>, 2021 # eduard pintilie <eduard.pintilie(a)gmail.com>, 2021 # Emma Peel, 2021 +# Legend Youtuber, 2021 # msgid "" msgstr "" @@ -17,7 +18,7 @@ msgstr "" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2021-06-29 12:10+CET\n" "PO-Revision-Date: 2019-12-11 10:50+0000\n" -"Last-Translator: Emma Peel, 2021\n" +"Last-Translator: Legend Youtuber, 2021\n" "Language-Team: Romanian (https://www.transifex.com/otf/teams/1519/ro/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -1832,7 +1833,7 @@ msgstr "" #: https//community.torproject.org/training/checklist/ #: (content/training/checklist/contents+en.lrpage.body) msgid "* Leave an e-mail for further contact and support" -msgstr "" +msgstr "* Lăsați un e-mail pentru contact și asistență ulterioară" #: https//community.torproject.org/training/checklist/ #: (content/training/checklist/contents+en.lrpage.body) @@ -6312,7 +6313,7 @@ msgstr "" #: https//community.torproject.org/outreach/meetup/ #: (content/outreach/meetup/contents+en.lrpage.subtitle) msgid "Learn how to organize a Tor meetup with your friends." -msgstr "" +msgstr "Aflați cum să organizați o întâlnire Tor cu prietenii dvs." #: https//community.torproject.org/outreach/meetup/ #: (content/outreach/meetup/contents+en.lrpage.body)

1 0