commit 5ee8c07e7e3e601fce49fbc2b170227924be3804
Author:     Laslo Hunhold <[email protected]>
AuthorDate: Fri Mar 20 20:35:34 2020 +0100
Commit:     Laslo Hunhold <[email protected]>
CommitDate: Fri Mar 20 20:35:34 2020 +0100

    Fix unveil(2) usage
    
    Thanks to the feedback by z0lqLA! I forgot that unveil(NULL, NULL)
    only locks further unveil calls when there has been at least _one_ prior
    call to unveil!
    
    To fix this, we reorder the calls and also make sure to call unveil()
    before we disallow unveils via pledge.
    
    Signed-off-by: Laslo Hunhold <[email protected]>

diff --git a/main.c b/main.c
index c1ff489..eab952d 100644
--- a/main.c
+++ b/main.c
@@ -387,10 +387,13 @@ main(int argc, char *argv[])
                exit(0);
        default:
                /* limit ourselves even further while we are waiting */
-               eunveil(NULL, NULL);
                if (udsname) {
+                       eunveil(udsname, "c");
+                       eunveil(NULL, NULL);
                        epledge("stdio cpath", NULL);
                } else {
+                       eunveil("/", "");
+                       eunveil(NULL, NULL);
                        epledge("stdio", NULL);
                }
 

Reply via email to