Re: unveil dhclient (privileged process)

[Ricardo Mestre]

something like the below? I added a new define for /etc/resolv.conf since it's
now used on 2 different places and hardcoded the executable path to avoid
strange errors if running from a symlink directory as pointed out by remi@

Index: dhclient.c
===================================================================
RCS file: /cvs/src/sbin/dhclient/dhclient.c,v
retrieving revision 1.581
diff -u -p -u -r1.581 dhclient.c
--- dhclient.c  4 Nov 2018 19:10:34 -0000       1.581
+++ dhclient.c  6 Nov 2018 07:34:55 -0000
@@ -2234,6 +2234,13 @@ fork_privchld(struct interface_info *ifi
        if ((routefd = socket(AF_ROUTE, SOCK_RAW, 0)) == -1)
                fatal("socket(AF_ROUTE, SOCK_RAW)");
 
+       if (unveil(_PATH_RESOLV_CONF, "wc") == -1)
+               fatal("unveil");
+       if (unveil("/sbin/dhclient", "x") == -1)
+               fatal("unveil");
+       if (unveil(NULL, NULL) == -1)
+               fatal("unveil");
+
        while (quit == 0) {
                pfd[0].fd = priv_ibuf->fd;
                pfd[0].events = POLLIN;
Index: dhcpd.h
===================================================================
RCS file: /cvs/src/sbin/dhclient/dhcpd.h,v
retrieving revision 1.257
diff -u -p -u -r1.257 dhcpd.h
--- dhcpd.h     2 Nov 2018 16:15:55 -0000       1.257
+++ dhcpd.h     6 Nov 2018 07:34:55 -0000
@@ -153,6 +153,7 @@ struct interface_info {
 };
 
 #define        _PATH_DHCLIENT_CONF     "/etc/dhclient.conf"
+#define        _PATH_RESOLV_CONF       "/etc/resolv.conf"
 #define        _PATH_LEASE_DB          "/var/db/dhclient.leases"
 
 /* options.c */
Index: kroute.c
===================================================================
RCS file: /cvs/src/sbin/dhclient/kroute.c,v
retrieving revision 1.156
diff -u -p -u -r1.156 kroute.c
--- kroute.c    13 Jun 2018 01:37:54 -0000      1.156
+++ kroute.c    6 Nov 2018 07:34:55 -0000
@@ -594,7 +594,6 @@ write_resolv_conf(void)
 void
 priv_write_resolv_conf(char *contents)
 {
-       const char      *path = "/etc/resolv.conf";
        ssize_t          n;
        size_t           sz;
        int              fd;
@@ -602,21 +601,21 @@ priv_write_resolv_conf(char *contents)
        if (contents == NULL)
                return;
 
-       fd = open(path, O_WRONLY | O_CREAT | O_TRUNC,
+       fd = open(_PATH_RESOLV_CONF, O_WRONLY | O_CREAT | O_TRUNC,
            S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
 
        if (fd == -1) {
-               log_warn("%s: open(%s)", log_procname, path);
+               log_warn("%s: open(%s)", log_procname, _PATH_RESOLV_CONF);
                return;
        }
 
        sz = strlen(contents);
        n = write(fd, contents, sz);
        if (n == -1)
-               log_warn("%s: write(%s)", log_procname, path);
+               log_warn("%s: write(%s)", log_procname, _PATH_RESOLV_CONF);
        else if ((size_t)n < sz)
                log_warnx("%s: write(%s): %zd of %zu bytes", log_procname,
-                   path, n, sz);
+                   _PATH_RESOLV_CONF, n, sz);
 
        close(fd);
 }