diff options
| author |   deraadt <deraadt@openbsd.org> | 2015-10-25 07:44:42 +0000 |
|---|---|---|
| committer | deraadt <deraadt@openbsd.org> | 2015-10-25 07:44:42 +0000 |
| commit | 326781423c096f4ed90cebc87cfe74b24ac794a0 (patch) | |
| tree | 43ad27409e82a9bc5825f22bcaf4caf9846ebac2 /usr.sbin/bind/lib/isc/unix/socket.c | |
| parent | Use sigaction() instead of signal() to avoid pulling in unnecessary (diff) | |
| download | wireguard-openbsd-326781423c096f4ed90cebc87cfe74b24ac794a0.tar.xz wireguard-openbsd-326781423c096f4ed90cebc87cfe74b24ac794a0.zip | |
pledge bind(1), dig(1), and nslookup(1). This modifies the underlying
ISC library to use socket(2) with the SOCK_DNS flag. As a result, the
port commands are disabled (such practice is rare in the wild these days,
and pretty incompatible with the DNS vs regular socket concept in pledge..)
ok bluhm phessler reyk, etc
Diffstat (limited to 'usr.sbin/bind/lib/isc/unix/socket.c')
| -rw-r--r-- | usr.sbin/bind/lib/isc/unix/socket.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/usr.sbin/bind/lib/isc/unix/socket.c b/usr.sbin/bind/lib/isc/unix/socket.c index fc300ba1e92..98bf327c19a 100644 --- a/usr.sbin/bind/lib/isc/unix/socket.c +++ b/usr.sbin/bind/lib/isc/unix/socket.c @@ -1503,10 +1503,10 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type, again: switch (type) { case isc_sockettype_udp: - sock->fd = socket(pf, SOCK_DGRAM, IPPROTO_UDP); + sock->fd = socket(pf, SOCK_DGRAM | SOCK_DNS, IPPROTO_UDP); break; case isc_sockettype_tcp: - sock->fd = socket(pf, SOCK_STREAM, IPPROTO_TCP); + sock->fd = socket(pf, SOCK_STREAM | SOCK_DNS, IPPROTO_TCP); break; case isc_sockettype_unix: sock->fd = socket(pf, SOCK_STREAM, 0); |