[tor-commits] [tor/release-0.3.3] Add the poll() syscall as permitted by the sandbox

[nickm at torproject.org]

commit 070eda5a21f580ee00ed64527ade4343b10e0fb6
Author: Nick Mathewson <nickm at torproject.org>
Date:   Tue Mar 20 08:22:28 2018 -0400

    Add the poll() syscall as permitted by the sandbox
    
    Apparently, sometimes getpwnam will call this.
    
    Fixes bug 25513.
---
 changes/feature25313 | 4 ++++
 src/common/sandbox.c | 3 ++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/changes/feature25313 b/changes/feature25313
new file mode 100644
index 000000000..90f421169
--- /dev/null
+++ b/changes/feature25313
@@ -0,0 +1,4 @@
+  o Minor features (sandbox):
+    - Explicitly permit the poll() system call when the Linux seccomp2-based
+      sandbox is enabled: apparently, some versions of libc use poll() when
+      calling getpwnam(). Closes ticket 25313.
diff --git a/src/common/sandbox.c b/src/common/sandbox.c
index b90ae0257..c1b7bfe5e 100644
--- a/src/common/sandbox.c
+++ b/src/common/sandbox.c
@@ -247,7 +247,8 @@ static int filter_nopar_gen[] = {
     SCMP_SYS(recvmsg),
     SCMP_SYS(recvfrom),
     SCMP_SYS(sendto),
-    SCMP_SYS(unlink)
+    SCMP_SYS(unlink),
+    SCMP_SYS(poll)
 };
 
 /* These macros help avoid the error where the number of filters we add on a