On 07 Jan 2017 21:14:17 -0700, "Andy Bradford" wrote: > As it turns out, it is because I have an approve entry in > /etc/login.conf and this requires the ability to fork the approval > program. When su tries to run approve it fails and I find the following > in dmesg: > > su(77960): syscall 2 "proc" > > ktrace also shows that pledge shut it down. So is the following patch > correct? I don't see any downsides, but perhaps there reasons for why > auth_approval happens last?
This looks fine to me. Since the approval script can do just about anything it doesn't make sense to try to pledge it. - todd
