diff options
| author | Roy Marples <roy@marples.name> | 2020-06-09 18:25:18 +0100 |
|---|---|---|
| committer | Roy Marples <roy@marples.name> | 2020-06-09 18:25:18 +0100 |
| commit | bc4a5e852a8b810bdbe5679ef3e03a634709d722 (patch) | |
| tree | 77ab40db824324751c6617c325ea57a8fcdcc3f1 /configure | |
| parent | 7e4b8c2ec9b521495a5c4906f8315f0530dd0ffd (diff) | |
| download | dhcpcd-bc4a5e852a8b810bdbe5679ef3e03a634709d722.tar.xz | |
privsep: Implement a resource limited sandbox
For systems without Capsicum or Pledge we can create a resource
limited sandbox provided that either ppoll(2) or works with
RLIMIT_NOFILES set to zero.
As far as dhcpcd is concerned, that means Linux and Solaris
won't work with this, but NetBSD and DragonFlyBSD will.
To achieve this, a special control proxy process will be spawned
just to accept new connections over the control socket because
this *cannot* be limited by RLIMIT_NOFILES.
Diffstat (limited to 'configure')
| -rwxr-xr-x | configure | 38 |
1 files changed, 24 insertions, 14 deletions
@@ -580,16 +580,18 @@ if [ "$PRIVSEP" = yes ]; then echo "#ifndef PRIVSEP_USER" >>$CONFIG_H echo "#define PRIVSEP_USER \"$PRIVSEP_USER\"" >>$CONFIG_H echo "#endif" >>$CONFIG_H - echo "DHCPCD_SRCS+= privsep.c privsep-root.c privsep-inet.c" \ + echo "PRIVSEP_SRCS= privsep.c privsep-root.c privsep-inet.c" \ >>$CONFIG_MK if [ -z "$INET" ] || [ "$INET" = yes ]; then - echo "DHCPCD_SRCS+= privsep-bpf.c" >>$CONFIG_MK + echo "PRIVSEP_SRCS+= privsep-bpf.c" >>$CONFIG_MK fi case "$OS" in - linux*) echo "DHCPCD_SRCS+= privsep-linux.c" >>$CONFIG_MK;; - solaris*|sunos*) echo "DHCPCD_SRCS+= privsep-sun.c" >>$CONFIG_MK;; - *) echo "DHCPCD_SRCS+= privsep-bsd.c" >>$CONFIG_MK;; + linux*) echo "PRIVSEP_SRCS+= privsep-linux.c" >>$CONFIG_MK;; + solaris*|sunos*) echo "PRIVSEP_SRCS+= privsep-sun.c" >>$CONFIG_MK;; + *) echo "PRIVSEP_SRCS+= privsep-bsd.c" >>$CONFIG_MK;; esac +else + echo "PRIVSEP_SRCS=" >>$CONFIG_MK fi echo "Using compiler .. $CC" @@ -622,16 +624,8 @@ fi [ "$CC" != cc ] && echo "CC= $CC" >>$CONFIG_MK $CC --version | $SED -e '1!d' -if [ -z "$EMBEDDED" -o "$EMBEDDED" = yes ]; then - echo "$DHCPCD_DEFS will be embedded in dhcpcd itself" - echo "DHCPCD_SRCS+= dhcpcd-embedded.c" >>$CONFIG_MK -else - echo "$DHCPCD_DEFS will be installed to $LIBEXECDIR" - echo "CPPFLAGS+= -DEMBEDDED_CONFIG=\\\"$LIBEXECDIR/dhcpcd-definitions.conf\\\"" >>$CONFIG_MK - echo "EMBEDDEDINSTALL= _embeddedinstall" >>$CONFIG_MK -fi - if [ "$PRIVSEP" = yes ]; then + PRIVSEP_CONTROLLER=true printf "Testing for capsicum ... " cat <<EOF >_capsicum.c #include <sys/capsicum.h> @@ -642,6 +636,7 @@ EOF if $XCC _capsicum.c -o _capsicum 2>&3; then echo "yes" echo "#define HAVE_CAPSICUM" >>$CONFIG_H + PRIVSEP_CONTROLLER=false else echo "no" fi @@ -657,10 +652,25 @@ EOF if $XCC _pledge.c -o _pledge 2>&3; then echo "yes" echo "#define HAVE_PLEDGE" >>$CONFIG_H + PRIVSEP_CONTROLLER=false else echo "no" fi rm -f _pledge.c _pledge + + if $PRIVSEP_CONTROLLER; then + echo "#define PRIVSEP_CONTROLLER" >>$CONFIG_H + echo "PRIVSEP_SRCS+= privsep-control.c" >>$CONFIG_MK + fi +fi + +if [ -z "$EMBEDDED" -o "$EMBEDDED" = yes ]; then + echo "$DHCPCD_DEFS will be embedded in dhcpcd itself" + echo "DHCPCD_SRCS+= dhcpcd-embedded.c" >>$CONFIG_MK +else + echo "$DHCPCD_DEFS will be installed to $LIBEXECDIR" + echo "CPPFLAGS+= -DEMBEDDED_CONFIG=\\\"$LIBEXECDIR/dhcpcd-definitions.conf\\\"" >>$CONFIG_MK + echo "EMBEDDEDINSTALL= _embeddedinstall" >>$CONFIG_MK fi if [ "$OS" = linux ]; then |