| Commit message (Collapse) | Author | Age | Files | Lines | |
|---|---|---|---|---|---|
| * | After fork(2) the pledge(2) in the parent proc can be reduced to |   mestre | 2019-11-30 | 1 | -1/+4 |
| | | | | | | | | | "stdio rpath sendfd" so that it can call {l,}stat/open and sendfd for imsg_* in order to send fds to the child proc which is already pledged by recvfd to receive them OK brynet@ deraadt@ | ||||
| * | dev_t is signed to permit passing -1 as an invalid condition, but the |   deraadt | 2019-02-05 | 1 | -3/+3 |
| | | | | | | | decomposition into major and minor is unsigned, so we should print them with %u instead of %d. ok guenther | ||||
| * | the parent process doesn't do much but open files, but just the same |   tedu | 2019-01-06 | 1 | -1/+4 |
| | | | | | | there's no reason it can't use pledge to enforce that. ok brynet deraadt | ||||
| * | Revert my changes in r1.60 back to nicm@'s latest for now. |   brynet | 2018-01-15 | 1 | -109/+239 |
| | | | | | | | Fixes "file *|grep" breakage reported by espie@ ok nicm, deraadt | ||||
| * | Default unknowns to application/octet-stream instead of x-not-regular-file. |   bentley | 2017-11-30 | 1 | -2/+2 |
| | | | | | | | This makes more sense and matches what the latest "other" file(1) now does. ok nicm@ | ||||
| * | close open fd after testing files, ensuring that fd isn't stdin. | brynet | 2017-07-01 | 1 | -1/+3 |
| | | | | | ok nicm@ | ||||
| * | Fix stdin file read support, accidentally broken in my last commit. | brynet | 2017-06-28 | 1 | -2/+6 |
| | | |||||
| * | remove excess #include | deraadt | 2017-06-28 | 1 | -6/+1 |
| | | |||||
| * | perform an initial pledge very early on, and drop tzset to later. | deraadt | 2017-06-28 | 1 | -4/+6 |
| | | | | | ok nicm brynet | ||||
| * | Simplify file(1) by removing the no longer necessary parent/child separation | brynet | 2017-06-28 | 1 | -234/+100 |
| | | | | | | | | | | | and just drop privileges in the main process. Also allows for a tighter "stdio" pledge. passing regress tests still pass ok nicm@ with helpful feedback | ||||
| * | Style nits; no binary change. |   nicm | 2017-04-18 | 1 | -9/+6 |
| | | |||||
| * | Tidy up some #include lines. | nicm | 2016-05-01 | 1 | -5/+9 |
| | | |||||
| * | Add --brief and --dereference, used by xdg-open/xdg-mime. |   jca | 2015-12-24 | 1 | -4/+6 |
| | | | | | From Ralf Horstmann, ok tb@ deraadt@ nicm@ sthen@ | ||||
| * | EAGAIN handling for imsg_read. OK henning@ benno@ |   claudio | 2015-12-05 | 1 | -2/+4 |
| | | |||||
| * | Break the message preparation bit of the main loop into its own function | nicm | 2015-11-13 | 1 | -39/+47 |
| | | | | | for less excessive level of indentation. | ||||
| * | Call stat not lstat with -L, makes links actually be followed. Reported | nicm | 2015-11-13 | 1 | -27/+29 |
| | | | | | by and ok semarie@. | ||||
| * | The file(1) magic-parsing process was using pledge "stdio getpw proc recvfd" | deraadt | 2015-10-17 | 1 | -2/+2 |
| | | | | | | | | | | | | | | | early on, then a set of getpwnam/setresuid/... before quickly dropping to "stdio recvfd". It receives fd's and runs the magic code on them in a chroot'd "stdio" jail. We can do better than that. Before the recent change, "proc" contained both the concepts of "forking" and "setuid". "id" is now split out as a seperate request, and it is exactly what this process needs momentarily. So this loses another window of opportunity, in case we have a major bug in .... hmm, it'd have to be in getpwnam.... ok tedu doug semarie gilles | ||||
| * | Change all tame callers to namechange to pledge(2). | deraadt | 2015-10-09 | 1 | -6/+6 |
| | | |||||
| * | Move from tame "cmsg" to tame "sendfd" or "recvfd", depending on which | deraadt | 2015-10-06 | 1 | -3/+3 |
| | | | | | way the process moves fd's. | ||||
| * | use the normal -1 check for tame failure | deraadt | 2015-10-05 | 1 | -3/+3 |
| | | |||||
| * | Add tame(2) to file(1) and drop the old systrace(4) sandbox. tame(2) is | nicm | 2015-10-04 | 1 | -8/+42 |
| | | | | | | | | | only applied to the child process, which requires the parent to not pass directory file descriptors (tame("cmsg") does not allow it). Because file(1) is already privsep, the permissions in the child can be quickly restricted: first to "stdio cmsg getpw proc" then after the privdrop to "stdio cmsg". | ||||
| * | use limits.h instead of sys/param.h to get PATH_MAX | deraadt | 2015-10-02 | 1 | -1/+2 |
| | | |||||
| * | Keep one byte for terminating '\0'. |   tobias | 2015-07-12 | 1 | -2/+2 |
| | | | | | ok nicm@ | ||||
| * | Properly handle files >= 4 GB on 32 bit architectures. | tobias | 2015-07-08 | 1 | -4/+5 |
| | | | | | with input by and ok nicm@ | ||||
| * | Support - to read from stdin, from Sebastien Marie. | nicm | 2015-05-30 | 1 | -4/+16 |
| | | |||||
| * | millert points out I can just call tzset() early to avoid having to | nicm | 2015-05-29 | 1 | -1/+4 |
| | | | | | permit access() in the child. | ||||
| * | Only mmap() on regular files; mmap() on /dev/stdin will happily map as | nicm | 2015-05-29 | 1 | -18/+20 |
| | | | | | | | much as we ask for but only the first page will be usable. (We could get the actual size with ioctl(FIONREAD) and mmap() that but it would need to be done in the parent - I think just using read() is simpler.) | ||||
| * | Make things a little less confusing by making fill_buffer self-contained | nicm | 2015-05-29 | 1 | -6/+9 |
| | | | | | | and return both the buffer and amount filled rather than having it modify the input struct and return a value. | ||||
| * | If reading into buffer, correct the stored file size at EOF, we don't | nicm | 2015-05-29 | 1 | -2/+2 |
| | | | | | | want to look at any garbage that might already be in the buffer after that. From Sebastien Marie. | ||||
| * | Silently fall back to /etc/magic if ~/.magic can't be opened, ok deraadt stsp | nicm | 2015-05-29 | 1 | -3/+1 |
| | | |||||
| * | probably makes more sense to show "file" as being mandatory; |   jmc | 2015-05-28 | 1 | -2/+2 |
| | | | | | from sebastien marie | ||||
| * | No longer need tricks with setvbuf(). Instead, we just give permission | deraadt | 2015-05-18 | 1 | -2/+1 |
| | | | | | | to call fstat() and fcntl(). ok nicm | ||||
| * | Add a missing free in the error path. |   lteo | 2015-04-28 | 1 | -1/+2 |
| | | | | | ok nicm@ | ||||
| * | Use a systrace(4) sandbox with a short whitelist of allowed syscalls for | nicm | 2015-04-27 | 1 | -18/+4 |
| | | | | | | the file(1) child process. Based on similar code in ssh sandbox-systrace.c. Idea and help from deraadt@. | ||||
| * | Add simple privilege separation to file(1). Two processes, file | nicm | 2015-04-27 | 1 | -116/+244 |
| | | | | | | descriptors and a few other bits are opened in parent and passed to child using imsg. Child currently drops to "nobody" but this will change. | ||||
| * | Don't support -s on FIFOs, it doesn't work well and the workarounds are | nicm | 2015-04-26 | 1 | -15/+7 |
| | | | | | a bit horrible. | ||||
| * | stat() the original link path not the resolved one which may be relative. | nicm | 2015-04-26 | 1 | -2/+2 |
| | | |||||
| * | Do not attempt to use ~/.magic if running as root (or issetugid()). | nicm | 2015-04-24 | 1 | -17/+19 |
| | | |||||
| * | We need to loop over the files once to work out the width of the labels | nicm | 2015-04-24 | 1 | -8/+17 |
| | | | | | before testing them. | ||||
| * | Trying to drop privileges means we can't handle ARG_MAX arguments, so | nicm | 2015-04-24 | 1 | -26/+14 |
| | | | | | remove it for now. | ||||
| * | Use symbolic constants for st_mode flags, no binary change. | nicm | 2015-04-24 | 1 | -3/+3 |
| | | |||||
| * | If ~/.magic exists but can't be used, fail rather than silently falling | nicm | 2015-04-24 | 1 | -1/+5 |
| | | | | | back to /etc/magic. | ||||
| * | New implementation of the file(1) utility. This is a simplified, | nicm | 2015-04-24 | 1 | -392/+430 |
| | | | | | | | | | modernised version with a nearly complete magic(5) parser but omits some of the complex builtin tests (notably ELF) and has a reduced set of options. ok deraadt | ||||
| * | Add missing <limits.h> to file.c and remove definition of PATH_MAX |   millert | 2015-01-16 | 1 | -5/+2 |
| | | | | | which masked the missing include. OK deraadt@ | ||||
| * | Replace <sys/param.h> with <limits.h> |   doug | 2015-01-16 | 1 | -5/+4 |
| | | | | | | | | | | | | | This patch is from Theo. I helped verify that removing <sys/param.h> doesn't change anything. This produces the same binaries before and after with clang 3.5 and gcc 4.9.4 on amd64. There is a slight difference in the way it is generated by our old gcc 4.2.1 despite the fact that the preprocessed input is almost identical. ok deraadt@ | ||||
| * | If MAXPATHLEN is undefined, do not set it to 512. Dangerous. | deraadt | 2015-01-16 | 1 | -2/+2 |
| | | |||||
| * | Make the file_mbswidth() function cope if wcwidth() returns -1. |   stsp | 2011-04-15 | 1 | -3/+7 |
| | | | | | ok mikeb millert | ||||
| * | rcsid[] and sccsid[] and copyright[] are essentially unmaintained (and | deraadt | 2009-10-27 | 1 | -5/+1 |
| | | | | | | | | unmaintainable). these days, people use source. these id's do not provide any benefit, and do hurt the small install media (the 33,000 line diff is essentially mechanical) ok with the idea millert, ok dms | ||||
| * | Fix usage; requested by jmc@ |   ajacoutot | 2009-10-26 | 1 | -4/+4 |
| | | | | | ok jmc@ ian@ | ||||
| * | Appease gcc2 (I wish people would write in C, rather than "latest crap | deraadt | 2009-08-27 | 1 | -5/+6 |
| | | | | | | gcc added") ok millert miod | ||||
 |
index : wireguard-openbsd | |
| WireGuard implementation for the OpenBSD kernel | Matt Dunwoodie |
| summaryrefslogtreecommitdiffstats |