tor

commit 1699f9b0b6b531fe0918dd89e52c0b8b82943eab
parent e302e214f3cd7a3f5f6170e9b9fb4e77d727d30a
Author: Peter Palfrader <weasel@debian.org>
Date:   Fri,  7 Jun 2024 19:29:52 +0200

fix sandbox for bandwidth authority

Diffstat:
A
changes/bug40933
 | 
3
+++
M
src/app/main/main.c
 | 
5
+++++
M
src/lib/fs/files.c
 | 
3
++-

3 files changed, 10 insertions(+), 1 deletion(-)
diff --git a/changes/bug40933 b/changes/bug40933
@@ -0,0 +1,3 @@
+  o Minor bugfixes (sandbox, bwauth):
+    - Fix sandbox to work for bandwidth authority. Fixes bug 40933; bugfix on
+      0.2.2.1-alpha
diff --git a/src/app/main/main.c b/src/app/main/main.c
@@ -926,6 +926,11 @@ sandbox_init_filter(void)
     OPEN_DATADIR("approved-routers");
     OPEN_DATADIR_SUFFIX("my-consensus-microdesc", ".tmp");
     OPEN_DATADIR_SUFFIX("my-consensus-ns", ".tmp");
+    if (options->V3BandwidthsFile) {
+      log_notice(LD_GENERAL, "Adding V3BandwidthsFile %s to sandboxing set.",
+                 options->V3BandwidthsFile);
+      OPEN(options->V3BandwidthsFile);
+    }
   }
 
   if (options->ServerDNSResolvConfFile)
diff --git a/src/lib/fs/files.c b/src/lib/fs/files.c
@@ -85,7 +85,8 @@ tor_open_cloexec(const char *path, int flags, unsigned mode)
 FILE *
 tor_fopen_cloexec(const char *path, const char *mode)
 {
-  FILE *result = fopen(path, mode);
+  const char *p = sandbox_intern_string(path);
+  FILE *result = fopen(p, mode);
 #ifdef FD_CLOEXEC
   if (result != NULL) {
     if (fcntl(fileno(result), F_SETFD, FD_CLOEXEC) == -1) {