diff options
| author |   mestre <mestre@openbsd.org> | 2020-08-19 14:23:26 +0000 |
|---|---|---|
| committer | mestre <mestre@openbsd.org> | 2020-08-19 14:23:26 +0000 |
| commit | 15e2c6823410e554b348cd3fb137566da656e866 (patch) | |
| tree | 05f0d080c6a58f67e7e3229b2a771db9db95e8ab | |
| parent | Allow SIOCSWGDPID and SIOCSWGMAXFLOW ioctls for non-root (diff) | |
| download | wireguard-openbsd-15e2c6823410e554b348cd3fb137566da656e866.tar.xz wireguard-openbsd-15e2c6823410e554b348cd3fb137566da656e866.zip | |
add unveil(2) again
this allows reading from anywhere in the filesystem (in order to read the
config file and those ones included from it), but also executing, which I
missed from my last attempt, because it's required for "check script(s)".
even though it's a broad permission, and the main proc cannot be pledged due to
forbidden ioctls, then this at least prevents it from creating/writing/deleting
files which is not required here.
OK benno@ a long time ago
| -rw-r--r-- | usr.sbin/relayd/relayd.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/usr.sbin/relayd/relayd.c b/usr.sbin/relayd/relayd.c index fc10929359f..d431e70e42b 100644 --- a/usr.sbin/relayd/relayd.c +++ b/usr.sbin/relayd/relayd.c @@ -1,4 +1,4 @@ -/* $OpenBSD: relayd.c,v 1.182 2019/09/15 19:23:29 rob Exp $ */ +/* $OpenBSD: relayd.c,v 1.183 2020/08/19 14:23:26 mestre Exp $ */ /* * Copyright (c) 2007 - 2016 Reyk Floeter <reyk@openbsd.org> @@ -223,6 +223,11 @@ main(int argc, char *argv[]) if (ps->ps_noaction == 0) log_info("startup"); + if (unveil("/", "rx") == -1) + err(1, "unveil"); + if (unveil(NULL, NULL) == -1) + err(1, "unveil"); + event_init(); signal_set(&ps->ps_evsigint, SIGINT, parent_sig_handler, ps); |