diff options
| author |   mestre <mestre@openbsd.org> | 2018-10-26 17:11:33 +0000 |
|---|---|---|
| committer | mestre <mestre@openbsd.org> | 2018-10-26 17:11:33 +0000 |
| commit | 30f341d9fe0b347f4b5815e95ad9957b8e4e2a9b (patch) | |
| tree | 30f825b68ff71e7bedc3a9a795ec1c246dd4c2cf /sys | |
| parent | The code path were we pass `pathname' in the arguments is already limited (diff) | |
| download | wireguard-openbsd-30f341d9fe0b347f4b5815e95ad9957b8e4e2a9b.tar.xz wireguard-openbsd-30f341d9fe0b347f4b5815e95ad9957b8e4e2a9b.zip | |
If we pass `file' via args then we need to unveil(2) it with read permission,
otherwise if omitted we need to unveil(2) both _PATH_UNIX and _PATH_KSYMS with
same permissions.
Unconditionally we need to also unveil(2) dbdir, which by default is
_PATH_VARDB but can be changed via args (-o directory), with read/write/create
permissions. There are a couple of temp files that will be created but it's
inside dbdir so there's no need to unveil(2) them individually.
Since we already call pledge(2) before, twice, we need to add "unveil" promise
to both of them, and finally call pledge(2) once again with the needed promises
except "unveil".
OK millert@
Diffstat (limited to 'sys')
0 files changed, 0 insertions, 0 deletions