CVSROOT: /cvs
Module name: src
Changes by: bry...@cvs.openbsd.org 2018/08/26 12:26:51
Modified files:
sbin/pflogd : privsep.c
Log message:
Unveil pflogd(8). Similiar to florian@'s recent changes to ifconfig(8),
the priviledged parent cannot be pledged due to certain ioctls, but we
can use unveil(2) to lock down its access to the filesystem.
To be able to use hostnames/dns in tcpdump-like filter expressions,
we unveil /etc/{resolv.conf,hosts,services} "r", kept in sync with the
kernel bypass for pledge("dns")
Additionally, we need to unveil /dev/bpf "r" and the output log file
"rwc".
The unpriviledged child is pledged "stdio recvfd" and thus does not need
any unveils.
With feedback/testing from florian@, deraadt@
ok florian@ deraadt@
