On Sat, Jun 08 2019, Florian Obser <[email protected]> wrote:
> On Fri, Jun 07, 2019 at 11:24:30PM +0100, Ricardo Mestre wrote:
>> i did that and for some for reason i didn't get it! it tries to open
>> timezone so it kinda looks like a red flag right there...
>>
>> apart from /dev do we need to look into TZ on this one as well? if TZ
>> var needs to be looked at then all bets are off :/
>
> this seems to do the right thing:
>
> diff --git sysctl.c sysctl.c
> index dc6abc16670..c74e706942a 100644
> --- sysctl.c
> +++ sysctl.c
> @@ -255,6 +255,13 @@ main(int argc, char *argv[])
> argc -= optind;
> argv += optind;
>
> + tzset(); /* for kern.boottime in localtime */
> +
> + if (unveil("/dev", "r") == -1)
> + err(1, "unveil");
sysctl(8) uses devname(3); the latter wants to use /var/run/dev.db and
then falls back on listing /dev. Both /var/run/dev.db and /dev should
be whitelisted I think.
--8<--
3461 sysctl CALL open(0x7fad42c9eeb,0x10000<O_RDONLY|O_CLOEXEC>)
3461 sysctl NAMI "/var/run/dev.db"
3461 sysctl RET open -1 errno 2 No such file or directory
3461 sysctl CALL
open(0x7fad42c8f19,0x30000<O_RDONLY|O_CLOEXEC|O_DIRECTORY>)
3461 sysctl NAMI "/dev/"
3461 sysctl RET open 3
-->8--
Naive question: should sysctl(8) be pledged? I'm not objecting but
I wonder what we are trying to protect us from, here.
> + if (unveil(NULL, NULL) == -1)
> + err(1, "unveil");
> +
> if (argc == 0 || (Aflag || aflag)) {
> debuginit();
> vfsinit();
--
jca | PGP : 0x1524E7EE / 5135 92C1 AD36 5293 2BDF DDCC 0DFA 74AE 1524 E7EE
