sarah
/
tor
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Let AF_UNIX connections through the sandbox 

Fixes bug 15003; bugfix on 0.2.6.3-alpha.
This commit is contained in:
Nick Mathewson 2015-02-23 12:33:58 -05:00
parent 7a1a0a4cd7
commit 21ac0cd2af
2 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
changes/bug15003 Normal file
View File

@ -0,0 +1,3 @@
o Major bugfixes (linux seccomp2 sandbox):
- Allow AF_UNIX hidden services to be used with the seccomp2 sandbox.
Fixes bug 15003; bugfix on 0.2.6.3-alpha.

5
src/common/sandbox.c
View File

@ -542,6 +542,11 @@ sb_socket(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
return rc;
}
rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket),
SCMP_CMP(0, SCMP_CMP_EQ, PF_UNIX),
SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, SOCK_STREAM),
SCMP_CMP(2, SCMP_CMP_EQ, 0));
rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket),
SCMP_CMP(0, SCMP_CMP_EQ, PF_NETLINK),
SCMP_CMP(1, SCMP_CMP_EQ, SOCK_RAW),