commit 7cf1dbfd51f17773e93b509d954371886243a0eb Author: Cristian Toader cristian.matei.toader@gmail.com Date: Tue Jul 23 10:14:25 2013 +0300
changed paramfilter type to intptr_t --- src/common/sandbox.c | 18 +++++++++--------- src/common/sandbox.h | 4 +++- 2 files changed, 12 insertions(+), 10 deletions(-)
diff --git a/src/common/sandbox.c b/src/common/sandbox.c index f041012..f757c8d 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -34,8 +34,8 @@
static ParFilter param_filter[] = { // Example entries - {SCMP_SYS(execve), "/usr/local/bin/tor", 0}, - {SCMP_SYS(execve), "/usr/local/bin/tor", 0} + {SCMP_SYS(execve), (intptr_t)("/usr/local/bin/tor"), 0}, + {SCMP_SYS(execve), (intptr_t)("/usr/local/bin/tor"), 0} };
/** Variable used for storing all syscall numbers that will be allowed with the @@ -165,9 +165,9 @@ get_prot_param(char *param) }
for (i = 0; i < filter_size; i++) { - if (param_filter[i].prot && !strncmp(param, param_filter[i].param, + if (param_filter[i].prot && !strncmp(param, (char*) param_filter[i].param, MAX_PARAM_LEN)) { - return param_filter[i].param; + return (char*)(param_filter[i].param); } }
@@ -190,7 +190,7 @@ add_param_filter(scmp_filter_ctx ctx) for (i = 0; i < filter_size; i++) { if (!param_filter[i].prot) { // allocating protected memory region for parameter - param_size = 1 + strnlen(param_filter[i].param, MAX_PARAM_LEN); + param_size = 1 + strnlen((char*) param_filter[i].param, MAX_PARAM_LEN); if (param_size == MAX_PARAM_LEN) { log_warn(LD_BUG, "(Sandbox) Parameter %i length too large!", i); } @@ -203,18 +203,18 @@ add_param_filter(scmp_filter_ctx ctx) }
// copying from non protected to protected + pointer reassign - memcpy(map, param_filter[i].param, param_size); - param_filter[i].param = map; + memcpy(map, (char*) param_filter[i].param, param_size); + param_filter[i].param = (intptr_t) map;
// protecting from writes - if (mprotect(param_filter[i].param, param_size, PROT_READ)) { + if (mprotect((char*) param_filter[i].param, param_size, PROT_READ)) { log_err(LD_BUG,"(Sandbox) failed to protect memory!"); return -1; } } // if not protected
rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, param_filter[i].syscall, 1, - SCMP_A0(SCMP_CMP_EQ, (intptr_t) param_filter[i].param)); + SCMP_A0(SCMP_CMP_EQ, param_filter[i].param)); if (rc != 0) { log_err(LD_BUG,"(Sandbox) failed to add syscall index %d, " "received libseccomp error %d", i, rc); diff --git a/src/common/sandbox.h b/src/common/sandbox.h index 4752f1a..bfb7a73 100644 --- a/src/common/sandbox.h +++ b/src/common/sandbox.h @@ -22,6 +22,8 @@
#endif
+#include "torint.h" + /** * Linux definitions */ @@ -34,7 +36,7 @@
typedef struct { int syscall; - char *param; + intptr_t param; // TODO: make this intptr_t to support multiple types char prot; } ParFilter;