[tor-commits] [tor/master] added support for numeric parameters, tested with rt_sigaction

[nickm at torproject.org]

commit 8b12170f23f4042610b3574b8edf3794fef245b4
Author: Cristian Toader <cristian.matei.toader at gmail.com>
Date:   Tue Jul 23 10:49:56 2013 +0300

    added support for numeric parameters, tested with rt_sigaction
---
 src/common/sandbox.c |   22 +++++++++++++++++-----
 src/common/sandbox.h |    8 +++++++-
 2 files changed, 24 insertions(+), 6 deletions(-)

diff --git a/src/common/sandbox.c b/src/common/sandbox.c
index f757c8d..7c73215 100644
--- a/src/common/sandbox.c
+++ b/src/common/sandbox.c
@@ -28,14 +28,25 @@
 
 #include <sys/mman.h>
 #include <sys/syscall.h>
+#include <bits/signum.h>
 #include <seccomp.h>
 #include <signal.h>
 #include <unistd.h>
 
 static ParFilter param_filter[] = {
     // Example entries
-    {SCMP_SYS(execve), (intptr_t)("/usr/local/bin/tor"), 0},
-    {SCMP_SYS(execve), (intptr_t)("/usr/local/bin/tor"), 0}
+    {SCMP_SYS(execve), PARAM_PTR, (intptr_t)("/usr/local/bin/tor"), 0},
+    {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGINT), 0},
+    {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGTERM), 0},
+    {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGPIPE), 0},
+    {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGUSR1), 0},
+    {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGUSR2), 0},
+    {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGHUP), 0},
+#ifdef SIGXFSZ
+    {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGXFSZ), 0},
+#endif
+    {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGCHLD), 0},
+
 };
 
 /** Variable used for storing all syscall numbers that will be allowed with the
@@ -101,7 +112,6 @@ static int general_filter[] = {
     SCMP_SYS(prctl),
     SCMP_SYS(read),
     SCMP_SYS(rename),
-    SCMP_SYS(rt_sigaction),
     SCMP_SYS(rt_sigprocmask),
     SCMP_SYS(rt_sigreturn),
 #ifdef __NR_sigreturn
@@ -166,7 +176,7 @@ get_prot_param(char *param)
 
   for (i = 0; i < filter_size; i++) {
     if (param_filter[i].prot && !strncmp(param, (char*) param_filter[i].param,
-        MAX_PARAM_LEN)) {
+        MAX_PARAM_LEN) && param_filter[i].ptype == PARAM_PTR) {
       return (char*)(param_filter[i].param);
     }
   }
@@ -188,7 +198,7 @@ add_param_filter(scmp_filter_ctx ctx)
 
   // for each parameter filter
   for (i = 0; i < filter_size; i++) {
-    if (!param_filter[i].prot) {
+    if (!param_filter[i].prot && param_filter[i].ptype == PARAM_PTR) {
       // allocating protected memory region for parameter
       param_size = 1 + strnlen((char*) param_filter[i].param, MAX_PARAM_LEN);
       if (param_size == MAX_PARAM_LEN) {
@@ -213,6 +223,8 @@ add_param_filter(scmp_filter_ctx ctx)
       }
     } // if not protected
 
+    param_filter[i].prot = 1;
+
     rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, param_filter[i].syscall, 1,
         SCMP_A0(SCMP_CMP_EQ, param_filter[i].param));
     if (rc != 0) {
diff --git a/src/common/sandbox.h b/src/common/sandbox.h
index bfb7a73..de5699e 100644
--- a/src/common/sandbox.h
+++ b/src/common/sandbox.h
@@ -34,9 +34,15 @@
 
 #define MAX_PARAM_LEN 32
 
+#define PARAM_PTR 0
+#define PARAM_NUM 1
+
 typedef struct {
   int syscall;
-  intptr_t param;  // TODO: make this intptr_t to support multiple types
+
+  char ptype;
+  intptr_t param;
+
   char prot;
 } ParFilter;