From eab8e7af522d18620450003667579eebaa339896 Mon Sep 17 00:00:00 2001
From: Daniel Pinto <danielpinto52@gmail.com>
Date: Wed, 29 Jul 2020 00:34:08 +0100
Subject: [PATCH 1/2] Fix startup crash with seccomp sandbox enabled #40072

Fix crash introduced in #40020. On startup, tor calls
check_private_dir on the data and key directories. This function
uses open instead of opendir on the received directory. Data and
key directoryes are only opened here, so the seccomp rule added
should be for open instead of opendir, despite the fact that they
are directories.
---
 src/app/main/main.c       |  8 ++++++--
 src/lib/sandbox/sandbox.c | 10 +---------
 2 files changed, 7 insertions(+), 11 deletions(-)

diff --git a/src/app/main/main.c b/src/app/main/main.c
index aceba78cfc..3f35d4d23f 100644
--- a/src/app/main/main.c
+++ b/src/app/main/main.c
@@ -1008,8 +1008,10 @@ sandbox_init_filter(void)
     OPEN_DATADIR2(name, name2 suffix);                  \
   } while (0)
 
+// KeyDirectory is a directory, but it is only opened in check_private_dir
+// which calls open instead of opendir
 #define OPEN_KEY_DIRECTORY() \
-  OPENDIR(options->KeyDirectory)
+  OPEN(options->KeyDirectory)
 #define OPEN_CACHEDIR(name)                      \
   sandbox_cfg_allow_open_filename(&cfg, get_cachedir_fname(name))
 #define OPEN_CACHEDIR_SUFFIX(name, suffix) do {  \
@@ -1023,7 +1025,9 @@ sandbox_init_filter(void)
     OPEN_KEYDIR(name suffix);                    \
   } while (0)
 
-  OPENDIR(options->DataDirectory);
+  // DataDirectory is a directory, but it is only opened in check_private_dir
+  // which calls open instead of opendir
+  OPEN(options->DataDirectory);
   OPEN_KEY_DIRECTORY();
 
   OPEN_CACHEDIR_SUFFIX("cached-certs", ".tmp");
diff --git a/src/lib/sandbox/sandbox.c b/src/lib/sandbox/sandbox.c
index 1903da70e8..2f26c5429b 100644
--- a/src/lib/sandbox/sandbox.c
+++ b/src/lib/sandbox/sandbox.c
@@ -657,15 +657,7 @@ sb_opendir(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
 
     if (param != NULL && param->prot == 1 && param->syscall
         == PHONY_OPENDIR_SYSCALL) {
-      if (libc_uses_openat_for_opendir()) {
-        rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(openat),
-            SCMP_CMP_NEG(0, SCMP_CMP_EQ, AT_FDCWD),
-            SCMP_CMP_STR(1, SCMP_CMP_EQ, param->value),
-            SCMP_CMP(2, SCMP_CMP_EQ, O_RDONLY|O_NONBLOCK|O_LARGEFILE|
-                O_DIRECTORY|O_CLOEXEC));
-      } else {
-        rc = allow_file_open(ctx, 0, param->value);
-      }
+      rc = allow_file_open(ctx, libc_uses_openat_for_opendir(), param->value);
       if (rc != 0) {
         log_err(LD_BUG,"(Sandbox) failed to add openat syscall, received "
             "libseccomp error %d", rc);

From c7502b65036c63851a35e37cd2835cfdff8ab3d3 Mon Sep 17 00:00:00 2001
From: Nick Mathewson <nickm@torproject.org>
Date: Wed, 29 Jul 2020 12:36:56 -0400
Subject: [PATCH 2/2] Add a changes file from mr 86 for 40072 fix.

---
 changes/bug40072 | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 changes/bug40072

diff --git a/changes/bug40072 b/changes/bug40072
new file mode 100644
index 0000000000..2b82f3f18b
--- /dev/null
+++ b/changes/bug40072
@@ -0,0 +1,4 @@
+  o Minor bugfixes (linux seccomp2 sandbox):
+    - Fix startup crash with seccomp sandbox enabled when tor tries to
+      open the data directory. Patch from Daniel Pinto. Fixes bug 40072;
+      bugfix on 0.4.4.3-alpha-dev.