[tor-bugs] #16216 [Tor]: sandboxing breaks with systemd watchdog support

[Tor Bug Tracker & Wiki]

#16216: sandboxing breaks with systemd watchdog support
--------------------+------------------------------
 Reporter:  weasel  |          Owner:
     Type:  defect  |         Status:  new
 Priority:  normal  |      Milestone:
Component:  Tor     |        Version:  Tor: 0.2.6.7
 Keywords:          |  Actual Points:
Parent ID:          |         Points:
--------------------+------------------------------
 systemd watchdog stuff opens a datagram unix socket to communicate with
 systemd.

 Currently, our sandboxing rules don't allow that.

 {{{
 --- a/src/common/sandbox.c
 +++ b/src/common/sandbox.c
 @@ -170,6 +170,7 @@ static int filter_nopar_gen[] = {
      SCMP_SYS(read),
      SCMP_SYS(rt_sigreturn),
      SCMP_SYS(sched_getaffinity),
 +    SCMP_SYS(sendmsg),
      SCMP_SYS(set_robust_list),
  #ifdef __NR_sigreturn
      SCMP_SYS(sigreturn),
 @@ -551,6 +552,13 @@ sb_socket(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
      return rc;

    rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket),
 +      SCMP_CMP(0, SCMP_CMP_EQ, PF_UNIX),
 +      SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, SOCK_DGRAM),
 +      SCMP_CMP(2, SCMP_CMP_EQ, 0));
 +  if (rc)
 +    return rc;
 +
 +  rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket),
        SCMP_CMP(0, SCMP_CMP_EQ, PF_NETLINK),
        SCMP_CMP(1, SCMP_CMP_EQ, SOCK_RAW),
        SCMP_CMP(2, SCMP_CMP_EQ, 0));
 }}}

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/16216>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online