commit 3dfe1c06396665d4008ba2ea54a0ad23d445df2b Author: Cristian Toader cristian.matei.toader@gmail.com Date: Thu Jul 25 13:25:20 2013 +0300
initia stages of runtime dynamic filters --- src/common/sandbox.c | 78 +++++++++++++------------------------------------- src/common/sandbox.h | 7 ++--- src/or/main.c | 40 ++++++++++++++++++++++++++ 3 files changed, 63 insertions(+), 62 deletions(-)
diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 1a842f9..a4afc36 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -33,9 +33,9 @@ #include <signal.h> #include <unistd.h>
-ParFilterDynamic *filter_dynamic = NULL; +sandbox_cfg_t *filter_dynamic = NULL;
-static ParFilterStatic filter_static[] = { +static sandbox_static_cfg_t filter_static[] = { // Example entries {SCMP_SYS(execve), PARAM_PTR, 0, (intptr_t)("/usr/local/bin/tor"), 0}, {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGINT), 0}, @@ -48,34 +48,6 @@ static ParFilterStatic filter_static[] = { {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGXFSZ), 0}, #endif {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGCHLD), 0}, - {SCMP_SYS(open), PARAM_PTR, 0, - (intptr_t)("/home/cristi/.tor/cached-certs"), 0}, - {SCMP_SYS(open), PARAM_PTR, 0, - (intptr_t)("/home/cristi/.tor/cached-consensus"), 0}, - {SCMP_SYS(open), PARAM_PTR, 0, - (intptr_t)("/home/cristi/.tor/unverified-consensus"), 0}, - {SCMP_SYS(open), PARAM_PTR, 0, - (intptr_t)("/home/cristi/.tor/cached-microdesc-consensus"), 0}, - {SCMP_SYS(open), PARAM_PTR, 0, - (intptr_t)("/home/cristi/.tor/cached-microdesc-consensus.tmp"), 0}, - {SCMP_SYS(open), PARAM_PTR, 0, - (intptr_t)("/home/cristi/.tor/cached-microdescs"), 0}, - {SCMP_SYS(open), PARAM_PTR, 0, - (intptr_t)("/home/cristi/.tor/cached-microdescs.new"), 0}, - {SCMP_SYS(open), PARAM_PTR, 0, - (intptr_t)("/home/cristi/.tor/unverified-microdesc-consensus"), 0}, - {SCMP_SYS(open), PARAM_PTR, 0, - (intptr_t)("/home/cristi/.tor/cached-descriptors"), 0}, - {SCMP_SYS(open), PARAM_PTR, 0, - (intptr_t)("/home/cristi/.tor/cached-descriptors.new"), 0}, - {SCMP_SYS(open), PARAM_PTR, 0, - (intptr_t)("/home/cristi/.tor/cached-extrainfo"), 0}, - {SCMP_SYS(open), PARAM_PTR, 0, - (intptr_t)("/home/cristi/.tor/state.tmp"), 0}, - {SCMP_SYS(open), PARAM_PTR, 0, - (intptr_t)("/home/cristi/.tor/unparseable-desc.tmp"), 0}, - {SCMP_SYS(open), PARAM_PTR, 0, - (intptr_t)("/home/cristi/.tor/unparseable-desc"), 0}, };
/** Variable used for storing all syscall numbers that will be allowed with the @@ -192,7 +164,7 @@ char* get_prot_param(char *param) { int i, filter_size; - ParFilterDynamic *elem; + sandbox_cfg_t *elem;
if (param == NULL) return NULL; @@ -256,36 +228,26 @@ prot_strdup(char* str) return res; }
-int -add_dynamic_param_filter(char *syscall, char ptype, char pindex, intptr_t val) +sandbox_cfg_t* +sandbox_cfg_new() { - ParFilterDynamic **elem; - - for (elem = &filter_dynamic; *elem != NULL; elem = &(*elem)->next); - - *elem = (ParFilterDynamic*) malloc(sizeof(ParFilterDynamic)); - (*elem)->next = NULL; - (*elem)->pindex = pindex; - (*elem)->ptype = ptype; + return NULL; +}
- switch (ptype) { - case PARAM_PTR: - (*elem)->param = (intptr_t) prot_strdup((char*) val); - (*elem)->prot = 1; - break; +int +sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file) +{ + sandbox_cfg_t *elem = (sandbox_cfg_t*) malloc(sizeof(sandbox_cfg_t));
- case PARAM_NUM: - (*elem)->param = val; - (*elem)->prot = 0; - break; - } + elem->syscall = SCMP_SYS(open); + elem->pindex = 0; + elem->ptype = PARAM_PTR; + elem->param = (intptr_t) prot_strdup((char*) file); + elem->prot = 1;
- // TODO: and so on ..? - if (!strcmp(syscall, "open")) { - (*elem)->syscall = SCMP_SYS(open); - } else if (!strcmp(syscall, "rt_sigaction")) { - (*elem)->syscall = SCMP_SYS(rt_sigaction); - } + // fifo + elem->next = filter_dynamic; + filter_dynamic = elem;
return 0; } @@ -294,7 +256,7 @@ static int add_param_filter(scmp_filter_ctx ctx) { int i, filter_size, rc = 0; - ParFilterDynamic *elem; + sandbox_cfg_t *elem;
if (filter_static != NULL) { filter_size = sizeof(filter_static) / sizeof(filter_static[0]); diff --git a/src/common/sandbox.h b/src/common/sandbox.h index dc765c7..2cb8ab8 100644 --- a/src/common/sandbox.h +++ b/src/common/sandbox.h @@ -45,7 +45,7 @@ typedef struct { intptr_t param;
char prot; -} ParFilterStatic; +} sandbox_static_cfg_t;
struct pfd_elem { int syscall; @@ -58,7 +58,7 @@ struct pfd_elem {
struct pfd_elem *next; }; -typedef struct pfd_elem ParFilterDynamic; +typedef struct pfd_elem sandbox_cfg_t;
/** * Linux 32 bit definitions @@ -81,8 +81,7 @@ typedef struct pfd_elem ParFilterDynamic; void sandbox_set_debugging_fd(int fd); int tor_global_sandbox(void); char* get_prot_param(char *param); -int add_dynamic_param_filter(char *syscall, char ptype, char pindex, - intptr_t val); +int sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file);
#endif /* SANDBOX_H_ */
diff --git a/src/or/main.c b/src/or/main.c index 618ee6e..8bcf927 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -2639,6 +2639,43 @@ find_flashcard_path(PWCHAR path, size_t size) } #endif
+static int +sandbox_cfg_init_open() +{ + sandbox_cfg_allow_open_filename(NULL, + get_datadir_fname("cached-certs")); + sandbox_cfg_allow_open_filename(NULL, + get_datadir_fname("cached-consensus")); + sandbox_cfg_allow_open_filename(NULL, + get_datadir_fname("unverified-consensus")); + sandbox_cfg_allow_open_filename(NULL, + get_datadir_fname("cached-microdesc-consensus")); + sandbox_cfg_allow_open_filename(NULL, + get_datadir_fname("cached-microdesc-consensus.tmp")); + sandbox_cfg_allow_open_filename(NULL, + get_datadir_fname("cached-microdescs")); + sandbox_cfg_allow_open_filename(NULL, + get_datadir_fname("cached-microdescs.tmp")); + sandbox_cfg_allow_open_filename(NULL, + get_datadir_fname("cached-microdescs.new")); + sandbox_cfg_allow_open_filename(NULL, + get_datadir_fname("unverified-microdesc-consensus")); + sandbox_cfg_allow_open_filename(NULL, + get_datadir_fname("cached-descriptors")); + sandbox_cfg_allow_open_filename(NULL, + get_datadir_fname("cached-descriptors.new")); + sandbox_cfg_allow_open_filename(NULL, + get_datadir_fname("cached-extrainfo")); + sandbox_cfg_allow_open_filename(NULL, + get_datadir_fname("state.tmp")); + sandbox_cfg_allow_open_filename(NULL, + get_datadir_fname("unparseable-desc.tmp")); + sandbox_cfg_allow_open_filename(NULL, + get_datadir_fname("unparseable-desc")); + + return 0; +} + /** Main entry point for the Tor process. Called from main(). */ /* This function is distinct from main() only so we can link main.c into * the unittest binary without conflicting with the unittests' main. */ @@ -2707,6 +2744,9 @@ tor_main(int argc, char *argv[]) return -1;
if (get_options()->Sandbox) { + if (sandbox_cfg_init_open() < 0) + return -1; + if (tor_global_sandbox()) { log_err(LD_BUG,"Failed to create syscall sandbox filter"); return -1;