From 070eda5a21f580ee00ed64527ade4343b10e0fb6 Mon Sep 17 00:00:00 2001
From: Nick Mathewson <nickm@torproject.org>
Date: Tue, 20 Mar 2018 08:22:28 -0400
Subject: [PATCH 1/2] Add the poll() syscall as permitted by the sandbox

Apparently, sometimes getpwnam will call this.

Fixes bug 25513.
---
 changes/feature25313 | 4 ++++
 src/common/sandbox.c | 3 ++-
 2 files changed, 6 insertions(+), 1 deletion(-)
 create mode 100644 changes/feature25313

diff --git a/changes/feature25313 b/changes/feature25313
new file mode 100644
index 000000000..90f421169
--- /dev/null
+++ b/changes/feature25313
@@ -0,0 +1,4 @@
+  o Minor features (sandbox):
+    - Explicitly permit the poll() system call when the Linux seccomp2-based
+      sandbox is enabled: apparently, some versions of libc use poll() when
+      calling getpwnam(). Closes ticket 25313.
diff --git a/src/common/sandbox.c b/src/common/sandbox.c
index b90ae0257..c1b7bfe5e 100644
--- a/src/common/sandbox.c
+++ b/src/common/sandbox.c
@@ -247,7 +247,8 @@ static int filter_nopar_gen[] = {
     SCMP_SYS(recvmsg),
     SCMP_SYS(recvfrom),
     SCMP_SYS(sendto),
-    SCMP_SYS(unlink)
+    SCMP_SYS(unlink),
+    SCMP_SYS(poll)
 };
 
 /* These macros help avoid the error where the number of filters we add on a

From 9f93bcd16d70b540c518acee56a440be12072ef7 Mon Sep 17 00:00:00 2001
From: Nick Mathewson <nickm@torproject.org>
Date: Tue, 20 Mar 2018 08:30:21 -0400
Subject: [PATCH 2/2] Remove sb_poll check: all poll() calls are ok.

---
 src/common/sandbox.c | 20 --------------------
 1 file changed, 20 deletions(-)

diff --git a/src/common/sandbox.c b/src/common/sandbox.c
index c1b7bfe5e..87fe08e88 100644
--- a/src/common/sandbox.c
+++ b/src/common/sandbox.c
@@ -1063,25 +1063,6 @@ sb_mremap(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
   return 0;
 }
 
-/**
- * Function responsible for setting up the poll syscall for
- * the seccomp filter sandbox.
- */
-static int
-sb_poll(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
-{
-  int rc = 0;
-  (void) filter;
-
-  rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(poll),
-      SCMP_CMP(1, SCMP_CMP_EQ, 1),
-      SCMP_CMP(2, SCMP_CMP_EQ, 10));
-  if (rc)
-    return rc;
-
-  return 0;
-}
-
 #ifdef __NR_stat64
 /**
  * Function responsible for setting up the stat64 syscall for
@@ -1156,7 +1137,6 @@ static sandbox_filter_func_t filter_func[] = {
     sb_flock,
     sb_futex,
     sb_mremap,
-    sb_poll,
 #ifdef __NR_stat64
     sb_stat64,
 #endif