diff options
| author |   brynet <brynet@openbsd.org> | 2017-09-08 19:10:57 +0000 |
|---|---|---|
| committer | brynet <brynet@openbsd.org> | 2017-09-08 19:10:57 +0000 |
| commit | a5f00fc02abc33ac8905dbfbabe00169eb396ed0 (patch) | |
| tree | 43e93043bb3ef3f2b51a19fc52557d1972d47b63 /usr.sbin/tcpdump/tcpdump.c | |
| parent | In compiler-rt, a few assembler implementations for i386 floating point (diff) | |
| download | wireguard-openbsd-a5f00fc02abc33ac8905dbfbabe00169eb396ed0.tar.xz wireguard-openbsd-a5f00fc02abc33ac8905dbfbabe00169eb396ed0.zip | |
fork+exec model for tcpdump(8); re-exec the privileged child after fork
While tcpdump isn't a daemon in the traditional sense, it's not uncommon
for people to have long running sessions. At least on OpenBSD, this is
even safe thanks to the existing privsep design by otto@, canacar@ and
pledge(2) work done by deraadt.
ok deraadt@
Diffstat (limited to 'usr.sbin/tcpdump/tcpdump.c')
| -rw-r--r-- | usr.sbin/tcpdump/tcpdump.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/usr.sbin/tcpdump/tcpdump.c b/usr.sbin/tcpdump/tcpdump.c index 5a5d2c600f9..d90fd45d7b8 100644 --- a/usr.sbin/tcpdump/tcpdump.c +++ b/usr.sbin/tcpdump/tcpdump.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tcpdump.c,v 1.79 2016/11/16 13:47:27 reyk Exp $ */ +/* $OpenBSD: tcpdump.c,v 1.80 2017/09/08 19:10:57 brynet Exp $ */ /* * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997 @@ -218,6 +218,10 @@ main(int argc, char **argv) else program_name = argv[0]; + /* '-P' used internally, exec privileged portion */ + if (argc >= 2 && strcmp("-P", argv[1]) == 0) + priv_exec(argc, argv); + if (priv_init(argc, argv)) error("Failed to setup privsep"); |