I set 'Sandbox 1' in /etc/tor/torrc and added a SocksPort with IsolateDestAddr and IsolateDestPort. CFLAGS="-march=native -O2 -pipe" CXXFLAGS="${CFLAGS}" USE="bindist mmx sse sse2 lvm cryptsetup hardened ssl seccomp mozilla pulseaudio X otr socks5 consolekit policykit xa libkms gudev dbus lock session startup-notification thunar sqlite minizip apng aspell xcomposite alsa udev gnome -qt4 -minimal -kde -crash-reporter pic -jit -systemd -cddb -jit -sendmail" Reproducible: Always Steps to Reproduce: 1. Make sure Tor is compiled with seccomp (add seccomp to USE flags) 2. Install libseccomp via portage 3. Populate /etc/tor/torrc ("SandBox 1" is crucial): User tor PIDFile /var/run/tor/tor.pid Log notice syslog Log notice file /var/log/tor/log DataDirectory /var/lib/tor/data SandBox 1 SocksPort 9050 SocksPort 9056 IsolateDestAddr IsolateDestPort 4. sudo service tor start 5. sudo cat /var/log/tor/log May 24 15:53:03.154 [notice] Tor v0.2.6.7 (git-9ccf019b168909ef) running on Linux with Libevent 2.0.22-stable, OpenSSL 1.0.1m and Zlib 1.2.8. May 24 15:53:03.154 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning May 24 15:53:03.154 [notice] Read configuration file "/etc/tor/torrc". May 24 15:53:03.158 [notice] Opening Socks listener on 127.0.0.1:9050 May 24 15:53:03.158 [notice] Opening Socks listener on 127.0.0.1:9056 May 24 15:53:03.000 [notice] Parsing GEOIP IPv4 file /usr/share/tor/geoip. May 24 15:53:03.000 [notice] Parsing GEOIP IPv6 file /usr/share/tor/geoip6. May 24 15:53:03.000 [notice] Bootstrapped 0%: Starting ============================================================ T= 1432479183 (Sandbox) Caught a bad syscall attempt (syscall socket) /usr/bin/tor(+0x13af51)[0x5556733f51] /lib64/libc.so.6(socket+0x7)[0x2c50e718507] /lib64/libc.so.6(socket+0x7)[0x2c50e718507] /lib64/libc.so.6(+0xf11a0)[0x2c50e7121a0] /lib64/libc.so.6(__vsyslog_chk+0x3ef)[0x2c50e7125ff] /lib64/libc.so.6(__syslog_chk+0x89)[0x2c50e7128e9] /usr/bin/tor(+0x12ec88)[0x5556727c88] /usr/bin/tor(tor_log+0xd0)[0x5556728660] /usr/bin/tor(control_event_bootstrap+0x1dc)[0x55566e8b9c] /usr/bin/tor(do_main_loop+0x8c)[0x55566309fc] /usr/bin/tor(tor_main+0x16c5)[0x55566339a5] /lib64/libc.so.6(__libc_start_main+0x11b)[0x2c50e642e9b] /usr/bin/tor(+0x33f49)[0x555662cf49] Actual Results: Crash. Expected Results: Continues to run. $ emerge --info Portage 2.2.18 (python 2.7.9-final-0, hardened/linux/amd64/no-multilib, gcc-4.8.4, glibc-2.20-r2, 3.18.9-hardened x86_64) ================================================================= System uname: Linux-3.18.9-hardened-x86_64-Intel-R-_Core-TM-_i3-2310M_CPU_@_2.10GHz-with-gentoo-2.2 KiB Mem: 3898428 total, 2957056 free KiB Swap: 0 total, 0 free Timestamp of repository gentoo: Fri, 22 May 2015 21:30:01 +0000 sh bash 4.3_p33-r2 ld GNU ld (Gentoo 2.24 p1.4) 2.24 distcc 3.1 x86_64-pc-linux-gnu [disabled] app-shells/bash: 4.3_p33-r2::gentoo dev-lang/perl: 5.20.2::gentoo dev-lang/python: 2.7.9-r1::gentoo, 3.3.5-r1::gentoo dev-util/cmake: 2.8.12.2-r1::gentoo dev-util/pkgconfig: 0.28-r2::gentoo sys-apps/baselayout: 2.2::gentoo sys-apps/openrc: 0.13.11::gentoo sys-apps/sandbox: 2.6-r1::gentoo sys-devel/autoconf: 2.13::gentoo, 2.69::gentoo sys-devel/automake: 1.14.1::gentoo sys-devel/binutils: 2.24-r3::gentoo sys-devel/gcc: 4.8.4::gentoo sys-devel/gcc-config: 1.7.3::gentoo sys-devel/libtool: 2.4.6::gentoo sys-devel/make: 4.1-r1::gentoo sys-kernel/linux-headers: 3.18::gentoo (virtual/os-headers) sys-libs/glibc: 2.20-r2::gentoo Repositories: gentoo location: /usr/portage sync-type: rsync sync-uri: rsync://rsync.gentoo.org/gentoo-portage priority: -1000 ACCEPT_KEYWORDS="amd64" ACCEPT_LICENSE="* -@EULA" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-march=native -O2 -pipe" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/gnupg/qualified.txt" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo" CXXFLAGS="-march=native -O2 -pipe" DISTDIR="/usr/portage/distfiles" FCFLAGS="-O2 -pipe" FEATURES="assume-digests binpkg-logs config-protect-if-modified distlocks ebuild-locks fixlafiles merge-sync news parallel-fetch preserve-libs protect-owned sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr" FFLAGS="-O2 -pipe" GENTOO_MIRRORS="http://ftp.halifax.rwth-aachen.de/gentoo/ http://ftp.spline.inf.fu-berlin.de/mirrors/gentoo/ http://ftp.uni-erlangen.de/pub/mirrors/gentoo ftp://ftp-stud.hs-esslingen.de/pub/Mirrors/gentoo/ rsync://mirror.bytemark.co.uk/gentoo/ http://mirror.qubenet.net/mirror/gentoo/ ftp://ftp.mirrorservice.org/sites/distfiles.gentoo.org/" LANG="en_GB.iso88591" LDFLAGS="-Wl,-O1 -Wl,--as-needed" MAKEOPTS="-j6" PKGDIR="/usr/portage/packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages" PORTAGE_TMPDIR="/var/tmp" USE="X acl alsa amd64 apng aspell berkdb bindist bzip2 cli consolekit cracklib crypt cryptsetup cxx dbus dri gdbm gnome gudev hardened iconv ipv6 justify libkms lock lvm minizip mmx mmxext modules mozilla ncurses nls nptl openmp otr pam pax_kernel pcre pic policykit pulseaudio readline seccomp session socks5 sqlite sse sse2 ssl startup-notification tcpd thunar udev unicode urandom xa xattr xcomposite xtpax zlib" ABI_X86="64" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="kexi words flow plan sheets stage tables krita karbon braindump author" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="mmx mmxext sse sse2" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ublox ubx" INPUT_DEVICES="synaptics evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php5-5" PYTHON_SINGLE_TARGET="python2_7" PYTHON_TARGETS="python2_7 python3_3" RUBY_TARGETS="ruby19 ruby20" USERLAND="GNU" VIDEO_CARDS="intel sna dri i915" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" Unset: CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LC_ALL, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, USE_PYTHON
I didn't forget about this bug, but I wasn't able to reproduce it. I'm going to be rapid stabilizing tor-0.2.6.10 soon (like about one week or so). Can you test again and see if this is still an issue. If you keep hitting it, then its probably something on your system but we'll still want to track it down in case it has deeper implications.
(In reply to Anthony Basile from comment #1) > I didn't forget about this bug, but I wasn't able to reproduce it. I'm > going to be rapid stabilizing tor-0.2.6.10 soon (like about one week or so). > Can you test again and see if this is still an issue. If you keep hitting > it, then its probably something on your system but we'll still want to track > it down in case it has deeper implications. I tested with tor-0.2.6.10 and found no issue with seccomp. Can you reopen this if you get more information about how to reproduce. Possibly this has been fixed since 0.2.6.7.
(In reply to Anthony Basile from comment #2) > (In reply to Anthony Basile from comment #1) > > I didn't forget about this bug, but I wasn't able to reproduce it. I'm > > going to be rapid stabilizing tor-0.2.6.10 soon (like about one week or so). > > Can you test again and see if this is still an issue. If you keep hitting > > it, then its probably something on your system but we'll still want to track > > it down in case it has deeper implications. > > I tested with tor-0.2.6.10 and found no issue with seccomp. Can you reopen > this if you get more information about how to reproduce. Possibly this has > been fixed since 0.2.6.7. This is fixed in 0.2.6.10. See upstream issue #16363 in the URL above.
