Hi tech@

rebound(8)'s parent proc doesn't seem to need much permissions to do what it
needs, here is the pledge for the parent for the following promises:

rpath: reload the configuration at reexec time (see below)
proc/exec: needed to reexec itself and kill child if needed

Comments? OK?

Index: rebound.c
===================================================================
RCS file: /cvs/src/usr.sbin/rebound/rebound.c,v
retrieving revision 1.84
diff -u -p -u -r1.84 rebound.c
--- rebound.c   31 May 2017 04:52:11 -0000      1.84
+++ rebound.c   16 Jun 2017 14:07:40 -0000
@@ -996,5 +996,8 @@ main(int argc, char **argv)
                logerr("daemon: %s", strerror(errno));
        daemonized = 1;
 
+       if (pledge("stdio rpath proc exec", NULL) == -1)
+               logerr("pledge failed");
+
        return monitorloop(ud, ld, ud6, ld6, confname);
 }

Reply via email to