From 9b4ac986cbe8867c24c8e77654a4b7e75f870738 Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Wed, 14 May 2014 13:53:14 -0400 Subject: Use tor_getpw{nam,uid} wrappers to fix bug 11946 When running with User set, we frequently try to look up our information in the user database (e.g., /etc/passwd). The seccomp2 sandbox setup doesn't let us open /etc/passwd, and probably shouldn't. To fix this, we have a pair of wrappers for getpwnam and getpwuid. When a real call to getpwnam or getpwuid fails, they fall back to a cached value, if the uid/gid matches. (Granting access to /etc/passwd isn't possible with the way we handle opening files through the sandbox. It's not desirable either.) --- src/or/connection.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'src/or/connection.c') diff --git a/src/or/connection.c b/src/or/connection.c index 3cc4e09fb..cef9172ff 100644 --- a/src/or/connection.c +++ b/src/or/connection.c @@ -1017,7 +1017,7 @@ connection_listener_new(const struct sockaddr *listensockaddr, tor_socket_t s = TOR_INVALID_SOCKET; /* the socket we're going to make */ or_options_t const *options = get_options(); #if defined(HAVE_PWD_H) && defined(HAVE_SYS_UN_H) - struct passwd *pw = NULL; + const struct passwd *pw = NULL; #endif uint16_t usePort = 0, gotPort = 0; int start_reading = 0; @@ -1157,7 +1157,7 @@ connection_listener_new(const struct sockaddr *listensockaddr, } #ifdef HAVE_PWD_H if (options->User) { - pw = getpwnam(options->User); + pw = tor_getpwnam(options->User); if (pw == NULL) { log_warn(LD_NET,"Unable to chown() %s socket: user %s not found.", address, options->User); -- cgit v1.2.3