[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #33346 [Core Tor/Tor]: Seccomp soft fail (no write) in 0.4.2.6
#33346: Seccomp soft fail (no write) in 0.4.2.6
-------------------------------------------------+-------------------------
Reporter: subjectfrosting | Owner: nickm
Type: defect | Status:
| needs_revision
Priority: Medium | Milestone: Tor:
| 0.4.4.x-final
Component: Core Tor/Tor | Version: 0.4.2.6
Severity: Normal | Resolution:
Keywords: easy? 035-backport 041-backport | Actual Points: .1
042-backport 043-backport |
Parent ID: | Points: .1
Reviewer: | Sponsor:
-------------------------------------------------+-------------------------
Comment (by subjectfrosting):
Nick and I discussed this on IRC earlier. I did try tampering with the
flags that we give openat() but no luck. I was able to reproduce the bug
on my amd64 machine too, so it is not ARM related.
Let me know if there's anything further I can try out. Nick suggested it
was likely to be one of two things:
* seccomp2 is not adding the rule that we think
* using wrong pointer for the file (must match handle, not just same
string)
I added my own logging on nick's request to see if the right path was
being detected, but this seemed normal:
{{{
write(1, "seccomp: allow_file_open called "..., 51seccomp: allow_file_open
called with use_openat:1
) = 51
write(1, "seccomp: allow_file_open called "..., 75seccomp: allow_file_open
called with file:/home/user/.tor/cached-consensus
openat(AT_FDCWD, "/home/user/.tor/cached-consensus", O_RDONLY|O_CLOEXEC) =
-1 EPERM (Operation not permitted)
write(1, "Mar 09 16:30:06.000 [warn] Could"..., 112Mar 09 16:30:06.000
[warn] Could not open "/home/user/.tor/cached-consensus" for mmap():
Operation not permitted
}}}
An except of my strace:
{{{
...
getpid() = 22986
sendto(7, "<29>Mar 9 14:26:07 Tor[22986]: "..., 69, MSG_NOSIGNAL, NULL,
0) = 69
unlinkat(AT_FDCWD, "/var/lib/tor/data/key-pinning-entries", 0) = -1 ENOENT
(No such file or directory)
openat(AT_FDCWD, "/var/lib/tor/data/cached-certs", O_RDONLY|O_CLOEXEC) =
-1 EPERM (Operation not permitted)
getpid() = 22986
sendto(7, "<28>Mar 9 14:26:07 Tor[22986]: "..., 105, MSG_NOSIGNAL, NULL,
0) = 105
openat(AT_FDCWD, "/var/lib/tor/data/cached-consensus", O_RDONLY|O_CLOEXEC)
= -1 EPERM (Operation not permitted)
getpid() = 22986
sendto(7, "<28>Mar 9 14:26:07 Tor[22986]: "..., 120, MSG_NOSIGNAL, NULL,
0) = 120
openat(AT_FDCWD, "/var/lib/tor/data/unverified-consensus",
O_RDONLY|O_CLOEXEC) = -1 EPERM (Operation not permitted)
getpid() = 22986
sendto(7, "<28>Mar 9 14:26:07 Tor[22986]: "..., 124, MSG_NOSIGNAL, NULL,
0) = 124
openat(AT_FDCWD, "/var/lib/tor/data/cached-microdesc-consensus",
O_RDONLY|O_CLOEXEC) = -1 EPERM (Operation not permitted)
getpid() = 22986
sendto(7, "<28>Mar 9 14:26:07 Tor[22986]: "..., 130, MSG_NOSIGNAL, NULL,
0) = 130
openat(AT_FDCWD, "/var/lib/tor/data/unverified-microdesc-consensus",
O_RDONLY|O_CLOEXEC) = -1 EPERM (Operation not permitted)
getpid() = 22986
sendto(7, "<28>Mar 9 14:26:07 Tor[22986]: "..., 134, MSG_NOSIGNAL, NULL,
0) = 134
openat(AT_FDCWD, "/var/lib/tor/data/cached-microdescs",
O_RDONLY|O_CLOEXEC) = -1 EPERM (Operation not permitted)
getpid() = 22986
sendto(7, "<28>Mar 9 14:26:07 Tor[22986]: "..., 121, MSG_NOSIGNAL, NULL,
0) = 121
openat(AT_FDCWD, "/var/lib/tor/data/cached-microdescs.new",
O_RDONLY|O_CLOEXEC) = -1 EPERM (Operation not permitted)
getpid() = 22986
sendto(7, "<28>Mar 9 14:26:07 Tor[22986]: "..., 114, MSG_NOSIGNAL, NULL,
0) = 114
openat(AT_FDCWD, "/var/lib/tor/data/cached-descriptors",
O_RDONLY|O_CLOEXEC) = -1 EPERM (Operation not permitted)
getpid() = 22986
sendto(7, "<28>Mar 9 14:26:07 Tor[22986]: "..., 122, MSG_NOSIGNAL, NULL,
0) = 122
newfstatat(AT_FDCWD, "/var/lib/tor/data/cached-descriptors.new",
0x7fefcc0258, 0) = -1 EPERM (Operation not permitted)
openat(AT_FDCWD, "/var/lib/tor/data/cached-extrainfo", O_RDONLY|O_CLOEXEC)
= -1 EPERM (Operation not permitted)
getpid() = 22986
sendto(7, "<28>Mar 9 14:26:07 Tor[22986]: "..., 120, MSG_NOSIGNAL, NULL,
0) = 120
newfstatat(AT_FDCWD, "/var/lib/tor/data/cached-extrainfo.new",
0x7fefcc0258, 0) = -1 EPERM (Operation not permitted)
getpid() = 22986
sendto(7, "<29>Mar 9 14:26:07 Tor[22986]: "..., 70, MSG_NOSIGNAL, NULL,
0) = 70
epoll_ctl(3, EPOLL_CTL_ADD, 6, {EPOLLIN, {u32=6, u64=6}}) = 0
epoll_ctl(3, EPOLL_CTL_ADD, 4, {EPOLLIN, {u32=4, u64=4}}) = 0
epoll_pwait(3, ^C0x558e1975d0, 32, 1000, NULL, 8) = -1 EINTR (Interrupted
system call)
strace: Process 22986 detached
}}}
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/33346#comment:7>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs