CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/10/02 19:38:25
Modified files:
sbin/isakmpd : policy.c
Log message:
The path generation must not contain '..' or '/' type patterns or it
can walk upwards and sideways. The privsep open() is now restricted by
a single unveil() inside the config directory, but files in relative config
directories can still be reached and create potentially confusing outcomes.
This is half of a repair from Franz Bettag before I restructured the privsep
to use unveil(), the other half of the repair is not needed because it applies
to code that no longer exists.
ok markus hshoexer bluhm, testing sthen mvs
