commit b0c1c700114aa8d4dfc180d85870c5bbe15fcacb Author: Nick Mathewson nickm@torproject.org Date: Tue May 27 14:50:44 2014 -0400
Make sandbox.c compile on arm
This is a minimal set of changes for compilation; I need a more recent kernel to test this stuff. --- changes/11622 | 3 +++ src/common/sandbox.c | 33 ++++++++++++++++++++++++++++++++- src/common/sandbox.h | 16 ---------------- 3 files changed, 35 insertions(+), 17 deletions(-)
diff --git a/changes/11622 b/changes/11622 new file mode 100644 index 0000000..9e4be41 --- /dev/null +++ b/changes/11622 @@ -0,0 +1,3 @@ + o Minor bugfixes (linux seccomp sandbox) + - Make the seccomp sandbox code compile with ARM linux. Fixes bug + 11622; bugfix on 0.2.5.1-alpha. \ No newline at end of file diff --git a/src/common/sandbox.c b/src/common/sandbox.c index bb2b3ed..e34268c 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -67,6 +67,28 @@ #include <execinfo.h> #endif
+/** + * Linux 32 bit definitions + */ +#if defined(__i386__) + +#define REG_SYSCALL REG_EAX +#define M_SYSCALL gregs[REG_SYSCALL] + +/** + * Linux 64 bit definitions + */ +#elif defined(__x86_64__) + +#define REG_SYSCALL REG_RAX +#define M_SYSCALL gregs[REG_SYSCALL] + +#elif defined(__arm__) + +#define M_SYSCALL arm_r7 + +#endif + /**Determines if at least one sandbox is active.*/ static int sandbox_active = 0; /** Holds the parameter list configuration for the sandbox.*/ @@ -113,7 +135,9 @@ static int filter_nopar_gen[] = { #ifdef __NR_getgid32 SCMP_SYS(getgid32), #endif +#ifdef __NR_getrlimt SCMP_SYS(getrlimit), +#endif SCMP_SYS(gettimeofday), SCMP_SYS(gettid), SCMP_SYS(getuid), @@ -126,7 +150,10 @@ static int filter_nopar_gen[] = { #endif SCMP_SYS(mkdir), SCMP_SYS(mlockall), +#ifdef __NR_mmap + /* XXXX restrict this in the same ways as mmap2 */ SCMP_SYS(mmap), +#endif SCMP_SYS(munmap), SCMP_SYS(read), SCMP_SYS(rt_sigreturn), @@ -245,8 +272,12 @@ static int sb_time(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { (void) filter; +#ifdef __NR_time return seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(time), SCMP_CMP(0, SCMP_CMP_EQ, 0)); +#else + return 0; +#endif }
/** @@ -1499,7 +1530,7 @@ sigsys_debugging(int nr, siginfo_t *info, void *void_context) if (!ctx) return;
- syscall = (int) ctx->uc_mcontext.gregs[REG_SYSCALL]; + syscall = (int) ctx->uc_mcontext.M_SYSCALL;
#ifdef USE_BACKTRACE depth = backtrace(syscall_cb_buf, MAX_DEPTH); diff --git a/src/common/sandbox.h b/src/common/sandbox.h index b572152..c3c6766 100644 --- a/src/common/sandbox.h +++ b/src/common/sandbox.h @@ -119,22 +119,6 @@ typedef struct { sandbox_cfg_t *filter_dynamic; } sandbox_t;
-/** - * Linux 32 bit definitions - */ -#if defined(__i386__) - -#define REG_SYSCALL REG_EAX - -/** - * Linux 64 bit definitions - */ -#elif defined(__x86_64__) - -#define REG_SYSCALL REG_RAX - -#endif - #endif // USE_LIBSECCOMP
#ifdef USE_LIBSECCOMP