Hi,
If we pass `file' via args then we need to unveil(2) it with read permission,
otherwise if omitted we need to unveil(2) both _PATH_UNIX and _PATH_KSYMS with
same permissions.
Unconditionally we need to also unveil(2) dbdir, which by default is
_PATH_VARDB but can be changed via args (-o directory), with read/write/create
permissions. There are a couple of temp files that will be created but it's
inside dbdir so there's no need to unveil(2) them individually.
Since we already call pledge(2) before, twice, we need to add "unveil" promise
to both of them, and finally call pledge(2) once again with the needed promises
except "unveil".
Comments? OK?
Index: kvm_mkdb.c
===================================================================
RCS file: /cvs/src/usr.sbin/kvm_mkdb/kvm_mkdb.c,v
retrieving revision 1.29
diff -u -p -u -r1.29 kvm_mkdb.c
--- kvm_mkdb.c 21 Nov 2017 12:07:00 -0000 1.29
+++ kvm_mkdb.c 25 Oct 2018 09:45:31 -0000
@@ -70,7 +70,7 @@ main(int argc, char *argv[])
char *nlistpath, *nlistname;
char dbdir[PATH_MAX];
- if (pledge("stdio rpath wpath cpath fattr getpw flock id", NULL) == -1)
+ if (pledge("stdio rpath wpath cpath fattr getpw flock id unveil", NULL)
== -1)
err(1, "pledge");
/* Try to use the kmem group to be able to fchown() in kvm_mkdb(). */
@@ -89,7 +89,7 @@ main(int argc, char *argv[])
warn("can't set rlimit data size");
}
- if (pledge("stdio rpath wpath cpath fattr flock", NULL) == -1)
+ if (pledge("stdio rpath wpath cpath fattr flock unveil", NULL) == -1)
err(1, "pledge");
strlcpy(dbdir, _PATH_VARDB, sizeof(dbdir));
@@ -114,6 +114,20 @@ main(int argc, char *argv[])
if (argc > 1)
usage();
+
+ if (argc > 0) {
+ if (unveil(argv[0], "r") == -1)
+ err(1, "unveil");
+ } else {
+ if (unveil(_PATH_UNIX, "r") == -1)
+ err(1, "unveil");
+ if (unveil(_PATH_KSYMS, "r") == -1)
+ err(1, "unveil");
+ }
+ if (unveil(dbdir, "rwc") == -1)
+ err(1, "unveil");
+ if (pledge("stdio rpath wpath cpath fattr flock", NULL) == -1)
+ err(1, "pledge");
/* If no kernel specified use _PATH_KSYMS and fall back to _PATH_UNIX */
if (argc > 0) {
