[tor-commits] [tor/release-0.4.3] Fix crash when tor is compiled with NSS and seccomp sandbox is enabled

[ahf at torproject.org]

commit 2913dbd6d9c1ee53c5a7524dd6693f5a6c6f8293
Author: Daniel Pinto <danielpinto52 at gmail.com>
Date:   Wed May 6 22:00:50 2020 +0100

    Fix crash when tor is compiled with NSS and seccomp sandbox is enabled
    
    Adds seccomp rules for socket and getpeername used by NSS
---
 changes/bug34130          |  4 ++++
 src/lib/sandbox/sandbox.c | 14 ++++++++++++++
 2 files changed, 18 insertions(+)

diff --git a/changes/bug34130 b/changes/bug34130
new file mode 100644
index 000000000..b1e5715fd
--- /dev/null
+++ b/changes/bug34130
@@ -0,0 +1,4 @@
+  o Minor bugfixes (linux seccomp sandbox nss):
+    - Fix startup crash when tor is compiled with --enable-nss and 
+      sandbox support is enabled. Fixes bug 34130; bugfix on
+      0.3.5.1-alpha. Patch by Daniel Pinto.
diff --git a/src/lib/sandbox/sandbox.c b/src/lib/sandbox/sandbox.c
index 8f577b066..b701c0016 100644
--- a/src/lib/sandbox/sandbox.c
+++ b/src/lib/sandbox/sandbox.c
@@ -265,6 +265,11 @@ static int filter_nopar_gen[] = {
     SCMP_SYS(listen),
     SCMP_SYS(connect),
     SCMP_SYS(getsockname),
+#ifdef ENABLE_NSS
+#ifdef __NR_getpeername
+    SCMP_SYS(getpeername),
+#endif
+#endif
     SCMP_SYS(recvmsg),
     SCMP_SYS(recvfrom),
     SCMP_SYS(sendto),
@@ -647,6 +652,15 @@ sb_socket(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
     }
   }
 
+#ifdef ENABLE_NSS
+  rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket),
+    SCMP_CMP(0, SCMP_CMP_EQ, PF_INET),
+    SCMP_CMP(1, SCMP_CMP_EQ, SOCK_STREAM),
+    SCMP_CMP(2, SCMP_CMP_EQ, IPPROTO_IP));
+  if (rc)
+    return rc;
+#endif
+
   rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket),
       SCMP_CMP(0, SCMP_CMP_EQ, PF_UNIX),
       SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, SOCK_STREAM),