aboutsummaryrefslogtreecommitdiff
path: root/src/common
Commit message (Collapse)AuthorAge
* sandbox: allow enough setsockopt to make ConstrainedSockets workNick Mathewson2014-05-29
| | | | fixes bug 12139; bugfix on 0.2.5.1-alpha
* sandbox: permit listen(2)Nick Mathewson2014-05-27
| | | | Fix for 12115; bugfix on 0.2.5.1-alpha
* Log the errno value if seccomp_load() fails.Nick Mathewson2014-05-27
| | | | | (This is how I found out I was trying to test with a kernel too old for seccomp. I think.)
* Make sandbox.c compile on armNick Mathewson2014-05-27
| | | | | This is a minimal set of changes for compilation; I need a more recent kernel to test this stuff.
* Merge remote-tracking branch 'andrea/bug11476'Nick Mathewson2014-05-22
|\
| * Add --disable-mempools configure optionAndrea Shepard2014-05-12
| |
* | sandbox: permit gettid, sched_getaffinityNick Mathewson2014-05-20
| | | | | | | | | | | | | | | | These are needed under some circumstances if we are running with expensive-hardening and sandbox at the same time. fixes 11477, bugfix on 0.2.5.4-alpha (where we introduced expensive-hardening)
* | sandbox: support logfile rotationNick Mathewson2014-05-20
| | | | | | | | Fixes bug 12032; bugfix on 0.2.5.1-alpha
* | sandbox: Disallow options which would make us call exec()Nick Mathewson2014-05-20
| | | | | | | | | | | | | | | | | | | | | | None of the things we might exec() can possibly run under the sanbox, so rather than crash later, we have to refuse to accept the configuration nice and early. The longer-term solution is to have an exec() helper, but wow is that risky. fixes 12043; bugfix on 0.2.5.1-alpha
* | whitespace fix, moreNick Mathewson2014-05-14
| |
* | Merge branch 'bug11946'Nick Mathewson2014-05-14
|\ \
| * | Improved comments on bug11946 fixNick Mathewson2014-05-14
| | |
| * | Use tor_getpw{nam,uid} wrappers to fix bug 11946Nick Mathewson2014-05-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When running with User set, we frequently try to look up our information in the user database (e.g., /etc/passwd). The seccomp2 sandbox setup doesn't let us open /etc/passwd, and probably shouldn't. To fix this, we have a pair of wrappers for getpwnam and getpwuid. When a real call to getpwnam or getpwuid fails, they fall back to a cached value, if the uid/gid matches. (Granting access to /etc/passwd isn't possible with the way we handle opening files through the sandbox. It's not desirable either.)
| * | Add a pair of wrapper functions: tor_getpwnam() and tor_getpwuid()Nick Mathewson2014-05-14
| | | | | | | | | | | | | | | We'll use these to deal with being unable to access the user DB after we install the sandbox, to fix bug 11946.
* | | whitespace fixNick Mathewson2014-05-14
|/ /
* | Merge branch 'bug9781_v2'Nick Mathewson2014-05-12
|\ \
| * | Log an error reply from tor-fw-helper correctly.Nick Mathewson2014-05-12
| | | | | | | | | | | | Fix for bug 9781; bugfix on cd05f35d2cdf50 in 0.2.4.2-alpha.
| * | Split portfw-error-logging code into a new function.Nick Mathewson2014-05-06
| | | | | | | | | | | | No code has changed; only moved. Part of a fix for 9781.
* | | Fix compilation of test_status.c with MSVCGisle Vanem2014-05-12
| | |
* | | Quench clang's complaints with -Wshorten-64-to-32 when time_t is not long.dana koch2014-05-11
| | | | | | | | | | | | | | | | | | On OpenBSD 5.4, time_t is a 32-bit integer. These instances contain implicit treatment of long and time_t as comparable types, so explicitly cast to time_t.
* | | Return success when get_total_system_memory() succeeds.Nick Mathewson2014-05-08
| | | | | | | | | | | | Fixes bug 11805; bugfix on 0.2.5.4-alpha.
* | | Move code-generation scripts to scripts/codegenNick Mathewson2014-05-07
|/ / | | | | | | | | Now that we have a scripts/* directory, let's put the scripts we use for generating C there.
* | Merge remote-tracking branch 'public/bug11233_diagnose'Nick Mathewson2014-05-01
|\ \
| * | Better log message when writing a CR in text mode on windowsNick Mathewson2014-03-27
| | | | | | | | | | | | Help to diagnose #11233
* | | Merge remote-tracking branch 'public/bug4345a_024'Nick Mathewson2014-05-01
|\ \ \
| * | | More hacking around spawn_func issuesNick Mathewson2014-02-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This time, we use a pthread_attr to make sure that if pthread_create succeeds, the thread is successfully detached. This probably isn't the big thing going on with 4345, since it'd be a bit weird for pthread_detach to be failing. But it's worth getting it right.
* | | | Merge remote-tracking branch 'public/bug11605_024'Nick Mathewson2014-04-29
|\ \ \ \ | |_|_|/ |/| | |
| * | | Make compilation of tor_memdup_nulterm() with dmallocNick Mathewson2014-04-25
| | | | | | | | | | | | | | | | Fixes bug 11605; bugfix on 0.2.4.10-alpha.
* | | | resolve a typo: sanboxing->sandboxing.Nick Mathewson2014-04-25
| | | |
* | | | Merge branch 'scanbuild_fixes'Nick Mathewson2014-04-25
|\ \ \ \
| * | | | scan-build: memarea_strndup() undefined behaviorNick Mathewson2014-04-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The memarea_strndup() function would have hit undefined behavior by creating an 'end' pointer off the end of a string if it had ever been given an 'n' argument bigger than the length of the memory ares that it's scanning. Fortunately, we never did that except in the unit tests. But it's not a safe behavior to leave lying around.
| * | | | scan-build: avoid undef behaior in tor_inet_ptonNick Mathewson2014-04-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If we had an address of the form "1.2.3.4" and we tried to pass it to tor_inet_pton with AF_INET6, it was possible for our 'eow' pointer to briefly move backwards to the point before the start of the string, before we moved it right back to the start of the string. C doesn't allow that, and though we haven't yet hit a compiler that decided to nuke us in response, it's best to fix. So, be more explicit about requiring there to be a : before any IPv4 address part of the IPv6 address. We would have rejected addresses without a : for not being IPv6 later on anyway.
| * | | | scan-build: Add a check for result from getaddrinfoNick Mathewson2014-04-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As documented, getaddrinfo always sets its result when it returns no error. But scan-build doesn't know that, and thinks we might be def
* | | | | Merge branch 'bug11396_v2_squashed'Nick Mathewson2014-04-24
|\ \ \ \ \ | |/ / / / |/| | | | | | | | | | | | | | Conflicts: src/or/main.c
| * | | | get_total_system_memory(): see how much RAM we haveNick Mathewson2014-04-24
| | | | |
* | | | | Improved message when running sandbox on Linux without libseccompNick Mathewson2014-04-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously we said "Sandbox is not implemented on this platform" on Linux boxes without libseccomp. Now we say that you need to build Tor built with libseccomp. Fixes bug 11543; bugfix on 0.2.5.1-alpha.
* | | | | Merge remote-tracking branch 'public/ticket11528_024'Nick Mathewson2014-04-17
|\ \ \ \ \
| * | | | | Elevate server TLS cipher preferences over clientNick Mathewson2014-04-17
| | |/ / / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | The server cipher list is (thanks to #11513) chosen systematically to put the best choices for Tor first. The client cipher list is chosen to resemble a browser. So let's set SSL_OP_CIPHER_SERVER_PREFERENCE to have the servers pick according to their own preference order.
* | | | | Remove spurious libevent include in sandbox.cNick Mathewson2014-04-17
| | | | |
* | | | | Log the name of the failing syscall on failureNick Mathewson2014-04-16
| | | | |
* | | | | Sandbox: permit O_NONBLOCK and O_NOCTTY for files we refuseNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenSSL needs this, or RAND_poll() will kill the process. Also, refuse with EACCESS, not errno==-1 (!).
* | | | | Don't allow change to ConnLimit while sandbox is activeNick Mathewson2014-04-16
| | | | |
* | | | | Use SCMP_CMP_MASKED_EQ to allow flags, not force themNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Older versions of Libevent are happy to open SOCK_DGRAM sockets non-cloexec and non-nonblocking, and then set those flags afterwards. It's nice to be able to allow a flag to be on or off in the sandbox without having to enumerate all its values. Also, permit PF_INET6 sockets. (D'oh!)
* | | | | Get Libevent's PRNG functioning under the linux sandboxNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Libevent uses an arc4random implementation (I know, I know) to generate DNS transaction IDs and capitalization. But it liked to initialize it either with opening /dev/urandom (which won't work under the sandbox if it doesn't use the right pointer), or with sysctl({CTL_KERN,KERN_RANDOM,RANDOM_UUIC}). To make _that_ work, we were permitting sysctl unconditionally. That's not such a great idea. Instead, we try to initialize the libevent PRNG _before_ installing the sandbox, and make sysctl always fail with EPERM under the sandbox.
* | | | | Make sure everything using an interned string is preceded by a logNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | | | (It's nice to know what we were about to rename before we died from renaming it.)
* | | | | Introduce arg-counting macros to wrap seccomp_rule_add()Nick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The compiler doesn't warn about this code: rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(openat), 1, SCMP_CMP(0, SCMP_CMP_EQ, AT_FDCWD), SCMP_CMP(1, SCMP_CMP_EQ, param->value), SCMP_CMP(2, SCMP_CMP_EQ, O_RDONLY|...)); but note that the arg_cnt argument above is only 1. This means that only the first filter (argument 0 == AT_FDCWD) is actually checked! This patch also fixes the above error in the openat() filter. Earlier I fixed corresponding errors in filters for rename() and mprotect().
* | | | | Fix sandbox protection for renameNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | (We were only checking the first parameter of each rename call.)
* | | | | Upgrade warning about missing interned string for sandboxNick Mathewson2014-04-16
| | | | |
* | | | | Have sandbox string protection include multi-valued parmeters.Nick Mathewson2014-04-16
| | | | |
* | | | | Clean up sandbox structures a bitNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Drop pindex,pindex2 as unused. Admit a type to avoid using a void*
generated by cgit v1.2.3 (git 2.25.4) at 2024-06-21 01:52:50 +0000