Re: pledge ifstated

2017-07-17 Thread Rob Pierce
> > > (intentionally) changing existing behaviour. > > > > > > Comments and suggestions welcome. > > > > > > Thanks! > > > > > > Rob > > > > An unnecessary call to log_info snuck in. Here is a clean diff. > > &g

Re: pledge ifstated

2017-07-16 Thread Rob Pierce
ons welcome. > > > > Thanks! > > > > Rob > > An unnecessary call to log_info snuck in. Here is a clean diff. > > Rob My original diff to initially pledge ifstated with "stdio rpath dns inet proc exec" was incorrectly polling from fetch_ifstate which resu

Re: pledge ifstated

2017-07-13 Thread Rob Pierce
On Mon, Jul 10, 2017 at 01:21:58PM -0400, Rob Pierce wrote: > The following diff is loosely based on the approach that was taken for > pledging mountd. Other code/approaches leveraged from various networking > daemons. > > This first step moves the ioctl with SIOCGIFDATA call to a privileged >

pledge ifstated

2017-07-13 Thread Rob Pierce
The following diff is loosely based on the approach that was taken for pledging mountd. Other code/approaches leveraged from various networking daemons. This first step moves the ioctl with SIOCGIFDATA call to a privileged child so we can at least pledge "stdio rpath dns inet proc exec" without