Opened 3 years ago

Closed 3 years ago

#21022 closed defect (fixed)

Add several syscalls to src/lib/syscall.c (Torsocks breaks seccomp)

Reported by: cypherpunks Owned by: dgoulet
Priority: High Milestone:
Component: Core Tor/Torsocks Version:
Severity: Normal Keywords:
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

It looks like Torsocks whitelists calls that are allowed to be made via the glibc syscall() function, but unfortunately the whitelist is too restrictive. For example seccomp() is not permitted, and that results in the syscall being denied (new kernels use that rather than prctl() to enable sandboxes). This results in any program that uses a seccomp sandbox being unsandboxed when used in combination with Torsocks!

Ideally, gettimeofday() and clock_gettime() would also be whitelisted, because they are harmless and calling them as syscalls directly is a handy way to avoid them being used as vDSOs. The same goes with fork(), where calling it directly is a handy way to avoid having to use the glibc wrapper, which uses clone() instead.

Child Tickets

Attachments (2)

add_seccomp_syscall.patch (1.7 KB) - added by cypherpunks 3 years ago.
whitelist_syscalls.patch (2.9 KB) - added by cypherpunks 3 years ago.
Whitelists seccomp(), gettimeofday(), clock_gettime(), and fork().

Download all attachments as: .zip

Change History (4)

comment:1 Changed 3 years ago by cypherpunks

Are there any other syscalls that would be a good idea to add, other than seccomp() in the attached patch? Is adding calls like the other ones mentioned worth it? It seems weird that Torsocks has to create a whitelist for this, and whitelist so few calls. It's very hacky.

Last edited 3 years ago by cypherpunks (previous) (diff)

Changed 3 years ago by cypherpunks

Attachment: add_seccomp_syscall.patch added

Changed 3 years ago by cypherpunks

Attachment: whitelist_syscalls.patch added

Whitelists seccomp(), gettimeofday(), clock_gettime(), and fork().

comment:2 Changed 3 years ago by dgoulet

Resolution: fixed
Status: newclosed

Merged! Thanks!

Note: See TracTickets for help on using tickets.