sandbox: allow access to cookie files, approved-routers

fixes part of 12064

src/or/config.c

@@ -3750,6 +3750,16 @@ options_transition_allowed(const or_options_t *old,
                         " while Sandbox is active");
       return -1;
     }
+    if (! opt_streq(old->CookieAuthFile, new_val->CookieAuthFile)) {
+      *msg = tor_strdup("Can't change CookieAuthFile while Sandbox is active");
+      return -1;
+    }
+    if (! opt_streq(old->ExtORPortCookieAuthFile,
+                    new_val->ExtORPortCookieAuthFile)) {
+      *msg = tor_strdup("Can't change ExtORPortCookieAuthFile"
+                        " while Sandbox is active");
+      return -1;
+    }
   }
 
   return 0;

src/or/control.c

@@ -160,7 +160,6 @@ static int write_stream_target_to_buf(entry_connection_t *conn, char *buf,
                                       size_t len);
 static void orconn_target_get_name(char *buf, size_t len,
                                    or_connection_t *conn);
-static char *get_cookie_file(void);
 
 /** Given a control event code for a message event, return the corresponding
  * log severity. */
@@ -2944,7 +2943,7 @@ handle_control_protocolinfo(control_connection_t *conn, uint32_t len,
   } else {
     const or_options_t *options = get_options();
     int cookies = options->CookieAuthentication;
-    char *cfile = get_cookie_file();
+    char *cfile = get_controller_cookie_file_name();
     char *abs_cfile;
     char *esc_cfile;
     char *methods;
@@ -4639,8 +4638,8 @@ control_event_conf_changed(const smartlist_t *elements)
 
 /** Helper: Return a newly allocated string containing a path to the
  * file where we store our authentication cookie. */
-static char *
-get_cookie_file(void)
+char *
+get_controller_cookie_file_name(void)
 {
   const or_options_t *options = get_options();
   if (options->CookieAuthFile && strlen(options->CookieAuthFile)) {
@@ -4664,7 +4663,7 @@ init_control_cookie_authentication(int enabled)
     return 0;
   }
 
-  fname = get_cookie_file();
+  fname = get_controller_cookie_file_name();
   retval = init_cookie_authentication(fname, "", /* no header */
                                       AUTHENTICATION_COOKIE_LEN,
                                       &authentication_cookie,

src/or/control.h

@@ -85,6 +85,7 @@ int control_event_buildtimeout_set(buildtimeout_set_event_t type,
 int control_event_signal(uintptr_t signal);
 
 int init_control_cookie_authentication(int enabled);
+char *get_controller_cookie_file_name(void);
 smartlist_t *decode_hashed_passwords(config_line_t *passwords);
 void disable_control_logging(void);
 void enable_control_logging(void);

src/or/main.c

@@ -2838,6 +2838,16 @@ sandbox_init_filter(void)
     smartlist_free(logfiles);
   }
 
+  {
+    char *fname;
+    if ((fname = get_controller_cookie_file_name())) {
+      sandbox_cfg_allow_open_filename(&cfg, fname);
+    }
+    if ((fname = get_ext_or_auth_cookie_file_name())) {
+      sandbox_cfg_allow_open_filename(&cfg, fname);
+    }
+  }
+
   // orport
   if (server_mode(get_options())) {
     sandbox_cfg_allow_open_filename_array(&cfg,
@@ -2862,6 +2872,7 @@ sandbox_init_filter(void)
         get_datadir_fname2("stats", "buffer-stats.tmp"),
         get_datadir_fname2("stats", "conn-stats"),
         get_datadir_fname2("stats", "conn-stats.tmp"),
+        get_datadir_fname("approved-routers"),
         get_datadir_fname("fingerprint"),
         get_datadir_fname("fingerprint.tmp"),
         get_datadir_fname("hashed-fingerprint"),