sandbox.h

Go to the documentation of this file.

/* Copyright (c) 2001 Matej Pfajfar.
 * Copyright (c) 2001-2004, Roger Dingledine.
 * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
 * Copyright (c) 2007-2017, The Tor Project, Inc. */
/* See LICENSE for licensing information */

#ifndef SANDBOX_H_
#define SANDBOX_H_

#include "orconfig.h"
#include "torint.h"

#ifndef SYS_SECCOMP

#define SYS_SECCOMP 1

#endif /* !defined(SYS_SECCOMP) */

#if defined(HAVE_SECCOMP_H) && defined(__linux__)
#define USE_LIBSECCOMP
#endif

struct sandbox_cfg_elem;

typedef struct sandbox_cfg_elem sandbox_cfg_t;

#ifdef USE_LIBSECCOMP

#include <sys/ucontext.h>
#include <seccomp.h>
#include <netdb.h>

#define PARAM_PTR 0
#define PARAM_NUM 1

typedef enum {
  LIBSECCOMP2 = 0
} SB_IMPL;

typedef struct smp_param {
  int syscall;

  char *value;
  char *value2;

  int prot;
} smp_param_t;

struct sandbox_cfg_elem {
  SB_IMPL implem;

  smp_param_t *param;

  struct sandbox_cfg_elem *next;
};

typedef int (*sandbox_filter_func_t)(scmp_filter_ctx ctx,
    sandbox_cfg_t *filter);

typedef struct {
  sandbox_filter_func_t *filter_func;

  sandbox_cfg_t *filter_dynamic;
} sandbox_t;

#endif /* defined(USE_LIBSECCOMP) */

#ifdef USE_LIBSECCOMP

int sandbox_add_addrinfo(const char *addr);

struct addrinfo;
int sandbox_getaddrinfo(const char *name, const char *servname,
                        const struct addrinfo *hints,
                        struct addrinfo **res);
void sandbox_freeaddrinfo(struct addrinfo *addrinfo);
void sandbox_free_getaddrinfo_cache(void);
#else /* !(defined(USE_LIBSECCOMP)) */
#define sandbox_getaddrinfo(name, servname, hints, res)  \
  getaddrinfo((name),(servname), (hints),(res))
#define sandbox_add_addrinfo(name) \
  ((void)(name))
#define sandbox_freeaddrinfo(addrinfo) \
  freeaddrinfo((addrinfo))
#define sandbox_free_getaddrinfo_cache()
#endif /* defined(USE_LIBSECCOMP) */

#ifdef USE_LIBSECCOMP

const char* sandbox_intern_string(const char *param);
#else /* !(defined(USE_LIBSECCOMP)) */
#define sandbox_intern_string(s) (s)
#endif /* defined(USE_LIBSECCOMP) */

sandbox_cfg_t * sandbox_cfg_new(void);

int sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file);

int sandbox_cfg_allow_chmod_filename(sandbox_cfg_t **cfg, char *file);
int sandbox_cfg_allow_chown_filename(sandbox_cfg_t **cfg, char *file);

/* DOCDOC */
int sandbox_cfg_allow_rename(sandbox_cfg_t **cfg, char *file1, char *file2);

int sandbox_cfg_allow_openat_filename(sandbox_cfg_t **cfg, char *file);

int sandbox_cfg_allow_stat_filename(sandbox_cfg_t **cfg, char *file);

int sandbox_init(sandbox_cfg_t* cfg);

int sandbox_is_active(void);

void sandbox_disable_getaddrinfo_cache(void);

#endif /* !defined(SANDBOX_H_) */