summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
...
| * | | | | | | | | | | | | | | | | | | | Merge remote-tracking branch 'public/sandbox_fixes_rebased_2'Nick Mathewson2014-04-16
| |\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \
| | * | | | | | | | | | | | | | | | | | | | add a changes file for the sandbox fixes seriesNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | |
| | * | | | | | | | | | | | | | | | | | | | Log the name of the failing syscall on failureNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | |
| | * | | | | | | | | | | | | | | | | | | | Block certain option transitions while sandbox enabledNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | |
| | * | | | | | | | | | | | | | | | | | | | Sandbox: permit O_NONBLOCK and O_NOCTTY for files we refuseNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenSSL needs this, or RAND_poll() will kill the process. Also, refuse with EACCESS, not errno==-1 (!).
| | * | | | | | | | | | | | | | | | | | | | Don't reload logs or rewrite pidfile while sandbox is activeNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | |
| | * | | | | | | | | | | | | | | | | | | | Don't allow change to ConnLimit while sandbox is activeNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | |
| | * | | | | | | | | | | | | | | | | | | | Allow reloading torrc and writing to router-stabilityNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | |
| | * | | | | | | | | | | | | | | | | | | | Use SCMP_CMP_MASKED_EQ to allow flags, not force themNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Older versions of Libevent are happy to open SOCK_DGRAM sockets non-cloexec and non-nonblocking, and then set those flags afterwards. It's nice to be able to allow a flag to be on or off in the sandbox without having to enumerate all its values. Also, permit PF_INET6 sockets. (D'oh!)
| | * | | | | | | | | | | | | | | | | | | | Add a couple of missing renames so the server sandbox works againNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | |
| | * | | | | | | | | | | | | | | | | | | | Get Libevent's PRNG functioning under the linux sandboxNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Libevent uses an arc4random implementation (I know, I know) to generate DNS transaction IDs and capitalization. But it liked to initialize it either with opening /dev/urandom (which won't work under the sandbox if it doesn't use the right pointer), or with sysctl({CTL_KERN,KERN_RANDOM,RANDOM_UUIC}). To make _that_ work, we were permitting sysctl unconditionally. That's not such a great idea. Instead, we try to initialize the libevent PRNG _before_ installing the sandbox, and make sysctl always fail with EPERM under the sandbox.
| | * | | | | | | | | | | | | | | | | | | | Make sure everything using an interned string is preceded by a logNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (It's nice to know what we were about to rename before we died from renaming it.)
| | * | | | | | | | | | | | | | | | | | | | Introduce arg-counting macros to wrap seccomp_rule_add()Nick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The compiler doesn't warn about this code: rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(openat), 1, SCMP_CMP(0, SCMP_CMP_EQ, AT_FDCWD), SCMP_CMP(1, SCMP_CMP_EQ, param->value), SCMP_CMP(2, SCMP_CMP_EQ, O_RDONLY|...)); but note that the arg_cnt argument above is only 1. This means that only the first filter (argument 0 == AT_FDCWD) is actually checked! This patch also fixes the above error in the openat() filter. Earlier I fixed corresponding errors in filters for rename() and mprotect().
| | * | | | | | | | | | | | | | | | | | | | Fix sandbox protection for renameNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (We were only checking the first parameter of each rename call.)
| | * | | | | | | | | | | | | | | | | | | | Upgrade warning about missing interned string for sandboxNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | |
| | * | | | | | | | | | | | | | | | | | | | Have sandbox string protection include multi-valued parmeters.Nick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | |
| | * | | | | | | | | | | | | | | | | | | | Clean up sandbox structures a bitNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Drop pindex,pindex2 as unused. Admit a type to avoid using a void*
| | * | | | | | | | | | | | | | | | | | | | Add missing rename function for non-linux platformsNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | |
| | * | | | | | | | | | | | | | | | | | | | Drop 'fr' parameter from sandbox code.Nick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Appearently, the majority of the filenames we pass to sandbox_cfg_allow() functions are "freeable right after". So, consider _all_ of them safe-to-steal, and add a tor_strdup() in the few cases that aren't. (Maybe buggy; revise when I can test.)
| | * | | | | | | | | | | | | | | | | | | | Remove nonsensical exec permission from sandbox code.Nick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | |
| | * | | | | | | | | | | | | | | | | | | | Add 'rename' to the sandboxed syscallsNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (If we don't restrict rename, there's not much point in restricting open, since an attacker could always use rename to make us open whatever they want.)
| | * | | | | | | | | | | | | | | | | | | | Only intern one copy of each magic string for the sandboxNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If we intern two copies of a string, later calls to sandbox_intern_string will give the wrong one sometimes.
| | * | | | | | | | | | | | | | | | | | | | Fix some initial sandbox issues.Nick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Allow files that weren't in the list; Allow the _sysctl syscall; allow accept4 with CLOEXEC and NONBLOCK.
| * | | | | | | | | | | | | | | | | | | | | Attribute 13304 and 13306 to 0.2.4.4-alpha.Nick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | |
| * | | | | | | | | | | | | | | | | | | | | Merge remote-tracking branch 'andrea/bug11304'Nick Mathewson2014-04-16
| |\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \
| | * | | | | | | | | | | | | | | | | | | | | Call connection_or_close_for_error() properly if write_to_buf() ever fails ↵Andrea Shepard2014-04-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | on an orconn
| * | | | | | | | | | | | | | | | | | | | | | Merge remote-tracking branch 'andrea/bug11306'Nick Mathewson2014-04-16
| |\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \
| | * | | | | | | | | | | | | | | | | | | | | | Avoid redundant calls to connection_mark_for_close() on listeners when ↵Andrea Shepard2014-04-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | setting DisableNetwork to 1
| | * | | | | | | | | | | | | | | | | | | | | | Close orconns correctly through channels when setting DisableNetwork to 1Andrea Shepard2014-04-15
| | |/ / / / / / / / / / / / / / / / / / / / /
| * | | | | | | | | | | | | | | | | | | | | | Merge remote-tracking branch 'public/bug11477'Nick Mathewson2014-04-16
| |\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \
| | * | | | | | | | | | | | | | | | | | | | | | New --enable-expensive-hardening optionNick Mathewson2014-04-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It turns on -fsanitize=address and -fsanitize=ubsan if they work. Most relays won't want this. Some clients may. Ticket 11477.
| * | | | | | | | | | | | | | | | | | | | | | | Merge branch '10267_plus_10896_rebased_twice'Nick Mathewson2014-04-16
| |\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ | | |_|_|/ / / / / / / / / / / / / / / / / / / / | |/| | | | | | | | | | | | | | | | | | | | | |
| | * | | | | | | | | | | | | | | | | | | | | | Changes file for 10896Nick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | |
| | * | | | | | | | | | | | | | | | | | | | | | Call pf-divert openbsd-specific, not no-linuxNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | |
| | * | | | | | | | | | | | | | | | | | | | | | Fix OSX compilation.Nick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | |
| | * | | | | | | | | | | | | | | | | | | | | | Whitespace, doc fixesNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | |
| | * | | | | | | | | | | | | | | | | | | | | | Educate tor on OpenBSD's use of divert-to rules with the pf firewall.dana koch2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This means that tor can run without needing to communicate with ioctls to the firewall, and therefore doesn't need to run with privileges to open the /dev/pf device node. A new TransProxyType is added for this purpose, "pf-divert"; if the user specifies this TransProxyType in their torrc, then the pf device node is never opened and the connection destination is determined with getsockname (as per pf(4)). The default behaviour (ie., when TransProxyType is "default" when using the pf firewall) is still to assume that pf is configured with rdr-to rules.
| | * | | | | | | | | | | | | | | | | | | | | | tor_addr_from_sockaddr() is applicable in ipfw code, so use it.Nick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | |
| | * | | | | | | | | | | | | | | | | | | | | | ipfw TransPort support on FreeBSD (10267)Nick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This isn't on by default; to get it, you need to set "TransProxyType ipfw". (The original patch had automatic detection for whether /dev/pf is present and openable, but that seems marginally fragile.)
| * | | | | | | | | | | | | | | | | | | | | | | Only expose clean_backtrace() if we'll implement itNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes windows compilation; bug not in any released Tor. Bugfix on cc9e86db.
| * | | | | | | | | | | | | | | | | | | | | | | Merge remote-tracking branch 'origin/maint-0.2.4'Nick Mathewson2014-04-16
| |\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ | | |_|_|/ / / / / / / / / / / / / / / / / / / / | |/| | | | | | / / / / / / / / / / / / / / / / | | | |_|_|_|_|/ / / / / / / / / / / / / / / / | | |/| | | | | | | | | | | | | | | | | | | |
| | * | | | | | | | | | | | | | | | | | | | | Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4Nick Mathewson2014-04-16
| | |\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ | | | | |_|_|_|_|_|_|_|_|_|/ / / / / / / / / / | | | |/| | | | | | | | | | | | | | | | | | |
| | | * | | | | | | | | | | | | | | | | | | | remove note about dannenberg; it has upgraded.Nick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | |
| | * | | | | | | | | | | | | | | | | | | | | Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4Nick Mathewson2014-04-16
| | |\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ | | | |/ / / / / / / / / / / / / / / / / / / / | | | | | | / / / / / / / / / / / / / / / / / | | | |_|_|/ / / / / / / / / / / / / / / / / | | |/| | | | | | | | | | | | | | | | | | |
| | | * | | | | | | | | | | | | | | | | | | Update the authority signing key blacklistNick Mathewson2014-04-16
| | | | |_|_|_|_|_|_|_|_|/ / / / / / / / / | | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Now it only has dannenberg
| * | | | | | | | | | | | | | | | | | | | Merge remote-tracking branch 'public/bug11465'Nick Mathewson2014-04-15
| |\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \
| | * | | | | | | | | | | | | | | | | | | | changes file for 11465Nick Mathewson2014-04-10
| | | | | | | | | | | | | | | | | | | | | |
| | * | | | | | | | | | | | | | | | | | | | Log a backtrace when the sandbox finds a failureNick Mathewson2014-04-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This involves some duplicate code between backtrace.c and sandbox.c, but I don't see a way around it: calling more functions would mean adding more steps to our call stack, and running clean_backtrace() against the wrong point on the stack.
| | * | | | | | | | | | | | | | | | | | | | Make the sandbox code allow the writev() syscall.Nick Mathewson2014-04-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Tor doesn't use it directly, but the glibc backtrace-to-fd code does
| * | | | | | | | | | | | | | | | | | | | | Answer a question in a comment; fix a wide line.Nick Mathewson2014-04-15
| | | | | | | | | | | | | | | | | | | | | |
generated by cgit v1.2.1 (git 2.18.0) at 2024-02-08 07:44:31 +0000