With the most recent commit ifstated can now be pledged in a straight forward
manner. A better pledge is possible with more work.

Does it make sense to get this one in now?

Rob

Index: ifstated.c
===================================================================
RCS file: /cvs/src/usr.sbin/ifstated/ifstated.c,v
retrieving revision 1.52
diff -u -p -r1.52 ifstated.c
--- ifstated.c  21 Jul 2017 16:32:18 -0000      1.52
+++ ifstated.c  22 Jul 2017 03:58:23 -0000
@@ -160,6 +160,9 @@ main(int argc, char *argv[])
            &rtfilter, sizeof(rtfilter)) == -1) /* not fatal */
                log_warn("%s: setsockopt tablefilter", __func__);
 
+       if (pledge("stdio rpath inet proc exec", NULL) == -1)
+               fatal("pledge");
+
        signal_set(&sigchld_ev, SIGCHLD, sigchld_handler, NULL);
        signal_add(&sigchld_ev, NULL);
 

Reply via email to