[tor-bugs] #9249 [Tor]: GSOC seccomp stage 2

[Tor Bug Tracker & Wiki]

#9249: GSOC seccomp stage 2
-----------------------------+--------------------------------------------
     Reporter:  ctoader      |      Owner:  nickm
         Type:  enhancement  |     Status:  needs_revision
     Priority:  normal       |  Milestone:
    Component:  Tor          |    Version:
   Resolution:               |   Keywords:  tor-relay gsoc seccomp sandbox
Actual Points:               |  Parent ID:  #5756
       Points:               |
-----------------------------+--------------------------------------------

Comment (by ctoader):

 Fixed linux x86_64 bug, libseccomp 1.0.1, where loading a filter was
 failing with -33. Notes:
 - send, recv are not defined on linux x86_64, libseccomp defines them as
 negative values (-108, -109).
 - they can be multiplexed using socketcall (they are on newer versions of
 libseccomp), but libseccomp 1.0.1 considers this to be wrong and returns
 an error.
 - fixed by ifdef-ing them out from the syscall filter for linux x86_64, as
 they are not required for this configuration (tested and works).

 Fixed mprotect exploit as discussed on irc. Notes:
 - I have added the 1MB extra buffer before the protected strings buffer
 - mprotect may not be used with lengths higher than 1MB

 I hope this is what you had in mind. Please let me know if there is
 anything else, or if the merge is done.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/9249#comment:19>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online