torproject/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-12-06 19:41:15 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

initia stages of runtime dynamic filters

Browse Source
This commit is contained in:
Cristian Toader
2013-07-25 13:25:20 +03:00
parent abe082e7d0
commit 3dfe1c0639
3 changed files with 63 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/common/sandbox.c
+20 -58
View File
@@ -33,9 +33,9 @@
#include <signal.h>
#include <unistd.h>
ParFilterDynamic *filter_dynamic = NULL;
sandbox_cfg_t *filter_dynamic = NULL;
static ParFilterStatic filter_static[] = {
static sandbox_static_cfg_t filter_static[] = {
// Example entries
{SCMP_SYS(execve), PARAM_PTR, 0, (intptr_t)("/usr/local/bin/tor"), 0},
{SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGINT), 0},
@@ -48,34 +48,6 @@ static ParFilterStatic filter_static[] = {
{SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGXFSZ), 0},
#endif
{SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGCHLD), 0},
{SCMP_SYS(open), PARAM_PTR, 0,
(intptr_t)("/home/cristi/.tor/cached-certs"), 0},
{SCMP_SYS(open), PARAM_PTR, 0,
(intptr_t)("/home/cristi/.tor/cached-consensus"), 0},
{SCMP_SYS(open), PARAM_PTR, 0,
(intptr_t)("/home/cristi/.tor/unverified-consensus"), 0},
{SCMP_SYS(open), PARAM_PTR, 0,
(intptr_t)("/home/cristi/.tor/cached-microdesc-consensus"), 0},
{SCMP_SYS(open), PARAM_PTR, 0,
(intptr_t)("/home/cristi/.tor/cached-microdesc-consensus.tmp"), 0},
{SCMP_SYS(open), PARAM_PTR, 0,
(intptr_t)("/home/cristi/.tor/cached-microdescs"), 0},
{SCMP_SYS(open), PARAM_PTR, 0,
(intptr_t)("/home/cristi/.tor/cached-microdescs.new"), 0},
{SCMP_SYS(open), PARAM_PTR, 0,
(intptr_t)("/home/cristi/.tor/unverified-microdesc-consensus"), 0},
{SCMP_SYS(open), PARAM_PTR, 0,
(intptr_t)("/home/cristi/.tor/cached-descriptors"), 0},
{SCMP_SYS(open), PARAM_PTR, 0,
(intptr_t)("/home/cristi/.tor/cached-descriptors.new"), 0},
{SCMP_SYS(open), PARAM_PTR, 0,
(intptr_t)("/home/cristi/.tor/cached-extrainfo"), 0},
{SCMP_SYS(open), PARAM_PTR, 0,
(intptr_t)("/home/cristi/.tor/state.tmp"), 0},
{SCMP_SYS(open), PARAM_PTR, 0,
(intptr_t)("/home/cristi/.tor/unparseable-desc.tmp"), 0},
{SCMP_SYS(open), PARAM_PTR, 0,
(intptr_t)("/home/cristi/.tor/unparseable-desc"), 0},
};
/** Variable used for storing all syscall numbers that will be allowed with the
@@ -192,7 +164,7 @@ char*
get_prot_param(char *param)
{
int i, filter_size;
ParFilterDynamic *elem;
sandbox_cfg_t *elem;
if (param == NULL)
return NULL;
@@ -256,36 +228,26 @@ prot_strdup(char* str)
return res;
}
int
add_dynamic_param_filter(char *syscall, char ptype, char pindex, intptr_t val)
sandbox_cfg_t*
sandbox_cfg_new()
{
ParFilterDynamic **elem;
return NULL;
}
for (elem = &filter_dynamic; *elem != NULL; elem = &(*elem)->next);
int
sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file)
{
sandbox_cfg_t *elem = (sandbox_cfg_t*) malloc(sizeof(sandbox_cfg_t));
*elem = (ParFilterDynamic*) malloc(sizeof(ParFilterDynamic));
(*elem)->next = NULL;
(*elem)->pindex = pindex;
(*elem)->ptype = ptype;
elem->syscall = SCMP_SYS(open);
elem->pindex = 0;
elem->ptype = PARAM_PTR;
elem->param = (intptr_t) prot_strdup((char*) file);
elem->prot = 1;
switch (ptype) {
case PARAM_PTR:
(*elem)->param = (intptr_t) prot_strdup((char*) val);
(*elem)->prot = 1;
break;
case PARAM_NUM:
(*elem)->param = val;
(*elem)->prot = 0;
break;
}
// TODO: and so on ..?
if (!strcmp(syscall, "open")) {
(*elem)->syscall = SCMP_SYS(open);
} else if (!strcmp(syscall, "rt_sigaction")) {
(*elem)->syscall = SCMP_SYS(rt_sigaction);
}
// fifo
elem->next = filter_dynamic;
filter_dynamic = elem;
return 0;
}
@@ -294,7 +256,7 @@ static int
add_param_filter(scmp_filter_ctx ctx)
{
int i, filter_size, rc = 0;
ParFilterDynamic *elem;
sandbox_cfg_t *elem;
if (filter_static != NULL) {
filter_size = sizeof(filter_static) / sizeof(filter_static[0]);
src/common/sandbox.h
+3 -4
View File
@@ -45,7 +45,7 @@ typedef struct {
intptr_t param;
char prot;
} ParFilterStatic;
} sandbox_static_cfg_t;
struct pfd_elem {
int syscall;
@@ -58,7 +58,7 @@ struct pfd_elem {
struct pfd_elem *next;
};
typedef struct pfd_elem ParFilterDynamic;
typedef struct pfd_elem sandbox_cfg_t;
/**
* Linux 32 bit definitions
@@ -81,8 +81,7 @@ typedef struct pfd_elem ParFilterDynamic;
void sandbox_set_debugging_fd(int fd);
int tor_global_sandbox(void);
char* get_prot_param(char *param);
int add_dynamic_param_filter(char *syscall, char ptype, char pindex,
intptr_t val);
int sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file);
#endif /* SANDBOX_H_ */
src/or/main.c
+40
View File
@@ -2639,6 +2639,43 @@ find_flashcard_path(PWCHAR path, size_t size)
}
#endif
static int
sandbox_cfg_init_open()
{
sandbox_cfg_allow_open_filename(NULL,
get_datadir_fname("cached-certs"));
sandbox_cfg_allow_open_filename(NULL,
get_datadir_fname("cached-consensus"));
sandbox_cfg_allow_open_filename(NULL,
get_datadir_fname("unverified-consensus"));
sandbox_cfg_allow_open_filename(NULL,
get_datadir_fname("cached-microdesc-consensus"));
sandbox_cfg_allow_open_filename(NULL,
get_datadir_fname("cached-microdesc-consensus.tmp"));
sandbox_cfg_allow_open_filename(NULL,
get_datadir_fname("cached-microdescs"));
sandbox_cfg_allow_open_filename(NULL,
get_datadir_fname("cached-microdescs.tmp"));
sandbox_cfg_allow_open_filename(NULL,
get_datadir_fname("cached-microdescs.new"));
sandbox_cfg_allow_open_filename(NULL,
get_datadir_fname("unverified-microdesc-consensus"));
sandbox_cfg_allow_open_filename(NULL,
get_datadir_fname("cached-descriptors"));
sandbox_cfg_allow_open_filename(NULL,
get_datadir_fname("cached-descriptors.new"));
sandbox_cfg_allow_open_filename(NULL,
get_datadir_fname("cached-extrainfo"));
sandbox_cfg_allow_open_filename(NULL,
get_datadir_fname("state.tmp"));
sandbox_cfg_allow_open_filename(NULL,
get_datadir_fname("unparseable-desc.tmp"));
sandbox_cfg_allow_open_filename(NULL,
get_datadir_fname("unparseable-desc"));
return 0;
}
/** Main entry point for the Tor process. Called from main(). */
/* This function is distinct from main() only so we can link main.c into
* the unittest binary without conflicting with the unittests' main. */
@@ -2707,6 +2744,9 @@ tor_main(int argc, char *argv[])
return -1;
if (get_options()->Sandbox) {
if (sandbox_cfg_init_open() < 0)
return -1;
if (tor_global_sandbox()) {
log_err(LD_BUG,"Failed to create syscall sandbox filter");
return -1;