[tor-bugs] #16579 [Tor]: (Sandbox) Caught a bad syscall attempt (syscall socket)

[Tor Bug Tracker & Wiki]

#16579: (Sandbox) Caught a bad syscall attempt (syscall socket)
-----------------------------+--------------------------------
     Reporter:  cypherpunks  |      Owner:
         Type:  defect       |     Status:  new
     Priority:  normal       |  Milestone:  Tor: 0.2.7.x-final
    Component:  Tor          |    Version:  Tor: 0.2.7.1-alpha
   Resolution:               |   Keywords:  026-backport
Actual Points:               |  Parent ID:
       Points:               |
-----------------------------+--------------------------------

Comment (by cypherpunks):

 Replying to [comment:7 cypherpunks]:
 > Replying to [comment:6 cypherpunks]:
 > > Replying to [comment:5 cypherpunks]:
 > > > This error may depends on how syslogd/rsyslog/syslog-ng is
 configured?
 > > >
 > > > `__vsyslog_chk()` belongs to glibc:/misc/syslog.c
 > > >
 > > > I cannot reproduce this on gentoo/hardening with normal syslog-ng
 listing on af_unix:/dev/log
 > >
 > > Are you on Gentoo Hardened with the hardened toolchain and kernel?
 > > I'm running on OpenRC which obviously affects how the syslog works. I
 haven't edited any syslog/rsyslog/etc configs, it's vanilla in that
 respect. I'm not using systemd.
 > > My libseccomp is 2.1.1.
 >
 > So maybe `__vsyslog_chk()` did not find an af_unix:/dev/log socket and
 try to connect to UDP/514 syslog port.
 > Can you check if you running a syslog daemon and which listen sockets
 are provided.
 > {{{
 > # ss -lp | grep syslog
 > u_str  LISTEN     0      0      /var/run/syslog-ng.ctl 1561
 * 0                    users:(("syslog-ng",pid=836,fd=7))
 > u_dgr  UNCONN     0      0      /dev/log 1563                  * 0
 users:(("syslog-ng",pid=836,fd=13))
 > }}}

 You're right. I didn't have a syslog running! Thanks. With syslog-ng,
 there's no crash anymore.
 But should Tor crash without a syslog-ng? I didn't realise I was lacking
 one (hadn't caused any issues).

 Obviously the Log line referring to syslog is an issue, but Tor probably
 shouldn't crash in seccomp.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/16579#comment:8>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online