1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
|
/* Copyright (c) 2001 Matej Pfajfar.
* Copyright (c) 2001-2004, Roger Dingledine.
* Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
* Copyright (c) 2007-2013, The Tor Project, Inc. */
/* See LICENSE for licensing information */
/**
* \file sandbox.h
* \brief Header file for sandbox.c.
**/
#ifndef SANDBOX_H_
#define SANDBOX_H_
#ifndef SYS_SECCOMP
/**
* Used by SIGSYS signal handler to check if the signal was issued due to a
* seccomp2 filter violation.
*/
#define SYS_SECCOMP 1
#endif
#include "torint.h"
/**
* Linux definitions
*/
#ifdef __linux__
#ifndef __USE_GNU
#define __USE_GNU
#endif
#include <sys/ucontext.h>
#include <seccomp.h>
#define MAX_PARAM_LEN 64
#define PARAM_PTR 0
#define PARAM_NUM 1
typedef struct {
int syscall;
char ptype;
char pindex;
intptr_t param;
char prot;
} sandbox_static_cfg_t;
struct pfd_elem {
int syscall;
char ptype;
char pindex;
intptr_t param;
char prot;
struct pfd_elem *next;
};
typedef struct pfd_elem sandbox_cfg_t;
typedef int (*sandbox_filter_func_t)(scmp_filter_ctx ctx,
sandbox_cfg_t *filter);
typedef struct {
// function pointers associated with filter
sandbox_filter_func_t *filter_func;
// filter function pointer parameters
sandbox_cfg_t *filter_dynamic;
} sandbox_t;
/**
* Linux 32 bit definitions
*/
#if defined(__i386__)
#define REG_SYSCALL REG_EAX
/**
* Linux 64 bit definitions
*/
#elif defined(__x86_64__)
#define REG_SYSCALL REG_RAX
#endif
#endif // __linux__
void sandbox_set_debugging_fd(int fd);
int tor_global_sandbox(void);
const char* sandbox_intern_string(const char *param);
sandbox_cfg_t * sandbox_cfg_new();
int sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file,
char fr);
int sandbox_cfg_allow_open_filename_array(sandbox_cfg_t **cfg, int num, ...);
int sandbox_cfg_allow_openat_filename(sandbox_cfg_t **cfg, char *file,
char fr);
int sandbox_cfg_allow_openat_filename_array(sandbox_cfg_t **cfg, int num, ...);
int sandbox_cfg_allow_execve(sandbox_cfg_t **cfg, char *com);
int sandbox_cfg_allow_execve_array(sandbox_cfg_t **cfg, int num, ...);
int sandbox_init(sandbox_cfg_t* cfg);
#endif /* SANDBOX_H_ */
|