commit 725e0c76e3df9d3ea4b861b3ff5279b23def4ef9 Author: Nick Mathewson nickm@torproject.org Date: Mon Mar 14 13:21:16 2016 -0400

Permit setrlimit, prlimit, prlimit64 calls.

We call setrlimit under some circumstances, and it can call prlimit and prlimit64 under the hood.

Fixes bug 15221. --- changes/bug15221 | 4 ++++ src/common/sandbox.c | 9 +++++++++ 2 files changed, 13 insertions(+)

diff --git a/changes/bug15221 b/changes/bug15221 new file mode 100644 index 0000000..ed72309 --- /dev/null +++ b/changes/bug15221 @@ -0,0 +1,4 @@ + o Minor bugfixes (sandbox): + - Allow the setrlimit syscall, and the prlimit and prlimit64 syscalls, + which some libc implementations + use under the hood. Fixes bug 15221. Bugfix on 0.2.5.1-alpha. diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 950a92f..bcbb3ce 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -177,11 +177,20 @@ static int filter_nopar_gen[] = { SCMP_SYS(mmap), #endif SCMP_SYS(munmap), +#ifdef __NR_prlimit + SCMP_SYS(prlimit), +#endif +#ifdef __NR_prlimit64 + SCMP_SYS(prlimit64), +#endif SCMP_SYS(read), SCMP_SYS(rt_sigreturn), SCMP_SYS(sched_getaffinity), SCMP_SYS(sendmsg), SCMP_SYS(set_robust_list), +#ifdef __NR_setrlimit + SCMP_SYS(setrlimit), +#endif #ifdef __NR_sigreturn SCMP_SYS(sigreturn), #endif