d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

MFp4 @229483:

Browse Source 
Limit communication pipe with privileged process to CAP_READ and CAP_WRITE.

Reviewed by:	brooks
Sponsored by:	The FreeBSD Foundation
This commit is contained in:
pjd 2013-07-03 22:17:29 +00:00
parent 11d993e694
commit 6526d2e66a
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
sbin/dhclient/dhclient.c
View File

@ -59,6 +59,8 @@ __FBSDID("$FreeBSD$");
#include "dhcpd.h"
#include "privsep.h"
#include <sys/capability.h>
#include <net80211/ieee80211_freebsd.h>
#ifndef _PATH_VAREMPTY
@ -470,6 +472,10 @@ main(int argc, char *argv[])
close(pipe_fd[0]);
privfd = pipe_fd[1];
if (cap_rights_limit(privfd, CAP_READ | CAP_WRITE) < 0 &&
errno != ENOSYS) {
error("can't limit private descriptor: %m");
}
if ((fd = open(path_dhclient_db, O_RDONLY|O_EXLOCK|O_CREAT, 0)) == -1)
error("can't open and lock %s: %m", path_dhclient_db);