Re: unveil dhclient (privileged process)

[Theo de Raadt]

Looks solid to me.

Ricardo Mestre <ser...@helheim.mooo.com> wrote:

> Since krw@ gave me feedback on yet another way to handle the defines I'd 
> rather
> leave that alone for now, it can be left as an exercise later on as you point
> out.
> 
> I'll go ahead and commit this instead if no one objects.
> 
> Index: dhclient.c
> ===================================================================
> RCS file: /cvs/src/sbin/dhclient/dhclient.c,v
> retrieving revision 1.641
> diff -u -p -u -r1.641 dhclient.c
> --- dhclient.c        1 Jul 2019 16:53:59 -0000       1.641
> +++ dhclient.c        11 Jul 2019 06:23:49 -0000
> @@ -2232,6 +2232,13 @@ fork_privchld(struct interface_info *ifi
>       if ((routefd = socket(AF_ROUTE, SOCK_RAW, 0)) == -1)
>               fatal("socket(AF_ROUTE, SOCK_RAW)");
>  
> +     if (unveil("/etc/resolv.conf", "wc") == -1)
> +             fatal("unveil");
> +     if (unveil("/etc/resolv.conf.tail", "r") == -1)
> +             fatal("unveil");
> +     if (unveil(NULL, NULL) == -1)
> +             fatal("unveil");
> +
>       while (quit == 0) {
>               pfd[0].fd = priv_ibuf->fd;
>               pfd[0].events = POLLIN;