From mboxrd@z Thu Jan 1 00:00:00 1970 From: Peter =?utf-8?q?M=C3=BCller?= To: development@lists.ipfire.org Subject: [PATCH 1/4] Tor: Enable syscall sandbox Date: Sat, 25 Sep 2021 09:07:58 +0200 Message-ID: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0681539581887358269==" List-Id: --===============0681539581887358269== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit This makes post-exploitation activities harder, in case the local Tor instance has been compromised. It is worth noticing that Tor won't respond to a "GETINFO address" command on the control port if sandboxed, but our CGI does not make use of it, and neither is any legitimate service on IPFire doing so. Tested on a small middle relay running on an IPFire machine. Signed-off-by: Peter Müller --- html/cgi-bin/tor.cgi | 1 + 1 file changed, 1 insertion(+) diff --git a/html/cgi-bin/tor.cgi b/html/cgi-bin/tor.cgi index 3349336ae..ce579aec1 100644 --- a/html/cgi-bin/tor.cgi +++ b/html/cgi-bin/tor.cgi @@ -730,6 +730,7 @@ sub BuildConfiguration() { open(FILE, ">$torrc"); # Global settings. + print FILE "Sandbox 1\n"; print FILE "ControlPort $TOR_CONTROL_PORT\n"; if ($settings{'TOR_ENABLED'} eq 'on') { -- 2.26.2 --===============0681539581887358269==--