[tor-commits] [tor/master] Make sandbox.c compile on arm

[nickm at torproject.org]

commit b0c1c700114aa8d4dfc180d85870c5bbe15fcacb
Author: Nick Mathewson <nickm at torproject.org>
Date:   Tue May 27 14:50:44 2014 -0400

    Make sandbox.c compile on arm
    
    This is a minimal set of changes for compilation; I need a more
    recent kernel to test this stuff.
---
 changes/11622        |    3 +++
 src/common/sandbox.c |   33 ++++++++++++++++++++++++++++++++-
 src/common/sandbox.h |   16 ----------------
 3 files changed, 35 insertions(+), 17 deletions(-)

diff --git a/changes/11622 b/changes/11622
new file mode 100644
index 0000000..9e4be41
--- /dev/null
+++ b/changes/11622
@@ -0,0 +1,3 @@
+  o Minor bugfixes (linux seccomp sandbox)
+    - Make the seccomp sandbox code compile with ARM linux. Fixes bug
+      11622; bugfix on 0.2.5.1-alpha.
\ No newline at end of file
diff --git a/src/common/sandbox.c b/src/common/sandbox.c
index bb2b3ed..e34268c 100644
--- a/src/common/sandbox.c
+++ b/src/common/sandbox.c
@@ -67,6 +67,28 @@
 #include <execinfo.h>
 #endif
 
+/**
+ * Linux 32 bit definitions
+ */
+#if defined(__i386__)
+
+#define REG_SYSCALL REG_EAX
+#define M_SYSCALL gregs[REG_SYSCALL]
+
+/**
+ * Linux 64 bit definitions
+ */
+#elif defined(__x86_64__)
+
+#define REG_SYSCALL REG_RAX
+#define M_SYSCALL gregs[REG_SYSCALL]
+
+#elif defined(__arm__)
+
+#define M_SYSCALL arm_r7
+
+#endif
+
 /**Determines if at least one sandbox is active.*/
 static int sandbox_active = 0;
 /** Holds the parameter list configuration for the sandbox.*/
@@ -113,7 +135,9 @@ static int filter_nopar_gen[] = {
 #ifdef __NR_getgid32
     SCMP_SYS(getgid32),
 #endif
+#ifdef __NR_getrlimt
     SCMP_SYS(getrlimit),
+#endif
     SCMP_SYS(gettimeofday),
     SCMP_SYS(gettid),
     SCMP_SYS(getuid),
@@ -126,7 +150,10 @@ static int filter_nopar_gen[] = {
 #endif
     SCMP_SYS(mkdir),
     SCMP_SYS(mlockall),
+#ifdef __NR_mmap
+    /* XXXX restrict this in the same ways as mmap2 */
     SCMP_SYS(mmap),
+#endif
     SCMP_SYS(munmap),
     SCMP_SYS(read),
     SCMP_SYS(rt_sigreturn),
@@ -245,8 +272,12 @@ static int
 sb_time(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
 {
   (void) filter;
+#ifdef __NR_time
   return seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(time),
        SCMP_CMP(0, SCMP_CMP_EQ, 0));
+#else
+  return 0;
+#endif
 }
 
 /**
@@ -1499,7 +1530,7 @@ sigsys_debugging(int nr, siginfo_t *info, void *void_context)
   if (!ctx)
     return;
 
-  syscall = (int) ctx->uc_mcontext.gregs[REG_SYSCALL];
+  syscall = (int) ctx->uc_mcontext.M_SYSCALL;
 
 #ifdef USE_BACKTRACE
   depth = backtrace(syscall_cb_buf, MAX_DEPTH);
diff --git a/src/common/sandbox.h b/src/common/sandbox.h
index b572152..c3c6766 100644
--- a/src/common/sandbox.h
+++ b/src/common/sandbox.h
@@ -119,22 +119,6 @@ typedef struct {
   sandbox_cfg_t *filter_dynamic;
 } sandbox_t;
 
-/**
- * Linux 32 bit definitions
- */
-#if defined(__i386__)
-
-#define REG_SYSCALL REG_EAX
-
-/**
- * Linux 64 bit definitions
- */
-#elif defined(__x86_64__)
-
-#define REG_SYSCALL REG_RAX
-
-#endif
-
 #endif // USE_LIBSECCOMP
 
 #ifdef USE_LIBSECCOMP