tor

commit aaa5ca366e83795f3ec7b35e879a3c8bc4e0b41f
parent de129e69ba1192f0c2ad46ac898df248944068eb
Author: Nick Mathewson <nickm@torproject.org>
Date:   Wed,  8 Aug 2018 09:26:23 -0400

Merge branch 'maint-0.3.3' into maint-0.3.4

Diffstat:
A
changes/bug25440
 | 
5
+++++
M
src/common/sandbox.c
 | 
2
+-

2 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/changes/bug25440 b/changes/bug25440
@@ -0,0 +1,5 @@
+  o Minor bugfixes (linux seccomp2 sandbox):
+    - Fix a bug in out sandboxing rules for the openat() syscall.
+      Previously, no openat() call would be permitted, which would break
+      filesystem operations on recent glibc versions. Fixes bug 25440;
+      bugfix on 0.2.9.15. Diagnosis and patch from Daniel Pinto.
diff --git a/src/common/sandbox.c b/src/common/sandbox.c
@@ -450,7 +450,7 @@ allow_file_open(scmp_filter_ctx ctx, int use_openat, const char *file)
 {
   if (use_openat) {
     return seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(openat),
-                              SCMP_CMP_STR(0, SCMP_CMP_EQ, AT_FDCWD),
+                              SCMP_CMP(0, SCMP_CMP_EQ, (unsigned int)AT_FDCWD),
                               SCMP_CMP_STR(1, SCMP_CMP_EQ, file));
   } else {
     return seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(open),