[tor-commits] [tor/master] sandbox: allow enough setsockopt to make ConstrainedSockets work

[nickm at torproject.org]

commit a6688f9cbb930ad139a7f3886684fcadeec59d30
Author: Nick Mathewson <nickm at torproject.org>
Date:   Thu May 29 11:04:32 2014 -0400

    sandbox: allow enough setsockopt to make ConstrainedSockets work
    
    fixes bug 12139; bugfix on 0.2.5.1-alpha
---
 changes/bug12139     |    4 ++++
 src/common/sandbox.c |   12 ++++++++++++
 2 files changed, 16 insertions(+)

diff --git a/changes/bug12139 b/changes/bug12139
new file mode 100644
index 0000000..8d31dab
--- /dev/null
+++ b/changes/bug12139
@@ -0,0 +1,4 @@
+  o Minor bugfixes (linux seccomp sandbox):
+    - Avoid crashing with the seccomp sandbox enabled along with
+      ConstrainedSockets. Fixes bug 12139; bugfix on 0.2.5.1-alpha.
+
diff --git a/src/common/sandbox.c b/src/common/sandbox.c
index ba1956b..c379151 100644
--- a/src/common/sandbox.c
+++ b/src/common/sandbox.c
@@ -587,6 +587,18 @@ sb_setsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
   if (rc)
     return rc;
 
+  rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt),
+      SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET),
+      SCMP_CMP(2, SCMP_CMP_EQ, SO_SNDBUF));
+  if (rc)
+    return rc;
+
+  rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt),
+      SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET),
+      SCMP_CMP(2, SCMP_CMP_EQ, SO_RCVBUF));
+  if (rc)
+    return rc;
+
 #ifdef IP_TRANSPARENT
   rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt),
       SCMP_CMP(1, SCMP_CMP_EQ, SOL_IP),