From 20e89453fde13ef154b69674255b905dc2b85fd7 Mon Sep 17 00:00:00 2001
From: Daniel Pinto <danielpinto52@gmail.com>
Date: Sat, 9 Jul 2016 00:36:37 +0100
Subject: [PATCH 1/2] Adds missing syscalls to seccomp filter.

Fixes #18397 which prevented tor starting with Sandbox 1.
---
 src/common/sandbox.c | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/src/common/sandbox.c b/src/common/sandbox.c
index bcbb3ce3f..b194c240d 100644
--- a/src/common/sandbox.c
+++ b/src/common/sandbox.c
@@ -207,7 +207,10 @@ static int filter_nopar_gen[] = {
     // getaddrinfo uses this..
     SCMP_SYS(stat64),
 #endif
-
+#ifdef __NR_sysinfo
+    // qsort uses this..
+    SCMP_SYS(sysinfo),
+#endif
     /*
      * These socket syscalls are not required on x86_64 and not supported with
      * some libseccomp versions (eg: 1.0.1)
@@ -646,6 +649,14 @@ sb_setsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
   if (rc)
     return rc;
 
+#ifdef HAVE_SYSTEMD
+  rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt),
+      SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET),
+      SCMP_CMP(2, SCMP_CMP_EQ, SO_SNDBUFFORCE));
+  if (rc)
+    return rc;
+#endif
+
 #ifdef IP_TRANSPARENT
   rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt),
       SCMP_CMP(1, SCMP_CMP_EQ, SOL_IP),
@@ -679,6 +690,14 @@ sb_getsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
   if (rc)
     return rc;
 
+#ifdef HAVE_SYSTEMD
+  rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt),
+      SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET),
+      SCMP_CMP(2, SCMP_CMP_EQ, SO_SNDBUF));
+  if (rc)
+    return rc;
+#endif
+
 #ifdef HAVE_LINUX_NETFILTER_IPV4_H
   rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt),
       SCMP_CMP(1, SCMP_CMP_EQ, SOL_IP),

From c1bfa65211257e5efb89c5ebc534339d52fa77c4 Mon Sep 17 00:00:00 2001
From: Nick Mathewson <nickm@torproject.org>
Date: Wed, 13 Jul 2016 09:19:23 -0400
Subject: [PATCH 2/2] changes file for bug18397

---
 changes/bug18397 | 7 +++++++
 1 file changed, 7 insertions(+)
 create mode 100644 changes/bug18397

diff --git a/changes/bug18397 b/changes/bug18397
new file mode 100644
index 000000000..53993da4e
--- /dev/null
+++ b/changes/bug18397
@@ -0,0 +1,7 @@
+  o Minor bugfixes (Linux seccomp2 sandbox):
+    - Add a few missing syscalls to the seccomp2 sandbox: sysinfo,
+      getsockopt(SO_SNDBUF), and setsockopt(SO_SNDBUFFORCE). On
+      some systems, these are required for Tor to start with
+      "Sandbox 1" enabled.
+      Fixes bug 18397; bugfix on 0.2.5.1-alpha. Patch from
+      Daniel Pinto.