[tor-bugs] #20782 [Applications/Tor Browser Sandbox]: Use a seccomp whitelist when the tor daemon is configured to use Bridges.

Mon Nov 28 19:32:32 UTC 2016

#20782: Use a seccomp whitelist when the tor daemon is configured to use Bridges.
----------------------------------------------+-------------------------
 Reporter:  yawning                           |          Owner:  yawning
     Type:  enhancement                       |         Status:  new
 Priority:  High                              |      Milestone:
Component:  Applications/Tor Browser Sandbox  |        Version:
 Severity:  Normal                            |     Resolution:
 Keywords:                                    |  Actual Points:
Parent ID:                                    |         Points:
 Reviewer:                                    |        Sponsor:
----------------------------------------------+-------------------------

Comment (by yawning):

 I missed a few calls when I wrote up my list of what's required, and since
 the tor profile now has mmap rules, there's even more stuff.

 `setsockopt` -> `arg1 == SOL_SOCKET && arg2 == SO_BROADCAST`, `arg1 ==
 SOL_IPV6 && arg2 == IPV6_V6ONLY`
 `mmap` -> `arg2 == PROT_NONE && (arg3 == MAP_PRIVATE|MAP_ANONYMOUS || arg3
 == MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS)`
 `getppid: 1`

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/20782#comment:4>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online