From: Nick Mathewson <nickm@torproject.org>
Date: Mon, 5 Sep 2016 18:25:58 +0000 (-0400)
Subject: For me, asan/ubsan require more syscalls.
X-Git-Tag: tor-0.2.9.3-alpha~31^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b9a43c8f43c84c99528d7f37f09abbd42482ae57;p=thirdparty%2Ftor.git

For me, asan/ubsan require more syscalls.

Permit sched_yield() and sigaltstack() in the sandbox.

Closes ticket 20063
---

diff --git a/changes/bug20063 b/changes/bug20063
new file mode 100644
index 0000000000..aa9ec23d03
--- /dev/null
+++ b/changes/bug20063
@@ -0,0 +1,6 @@
+  o Minor bugfixes (Linux seccomp2 sandbox):
+    - Add permission to run the sched_yield() and sigaltstack() system
+      calls, in order to support versions of Tor compiled with
+      asan or ubsan code that use these calls. Now "sandbox 1" and
+      "--enable-expensive-hardening" should be compatible.
+      Fixes bug 20063; bugfix on 0.2.5.1-alpha.
diff --git a/src/common/sandbox.c b/src/common/sandbox.c
index 37c1a9428f..24ba8a2997 100644
--- a/src/common/sandbox.c
+++ b/src/common/sandbox.c
@@ -184,11 +184,17 @@ static int filter_nopar_gen[] = {
     SCMP_SYS(read),
     SCMP_SYS(rt_sigreturn),
     SCMP_SYS(sched_getaffinity),
+#ifdef __NR_sched_yield
+    SCMP_SYS(sched_yield),
+#endif
     SCMP_SYS(sendmsg),
     SCMP_SYS(set_robust_list),
 #ifdef __NR_setrlimit
     SCMP_SYS(setrlimit),
 #endif
+#ifdef __NR_sigaltstack
+    SCMP_SYS(sigaltstack),
+#endif
 #ifdef __NR_sigreturn
     SCMP_SYS(sigreturn),
 #endif