diff options
| author | Roy Marples <roy@marples.name> | 2020-05-10 16:09:54 +0100 |
|---|---|---|
| committer | Roy Marples <roy@marples.name> | 2020-05-10 16:09:54 +0100 |
| commit | 8ec63e6a621b7f027121a31478450698641b84ba (patch) | |
| tree | c90effa39a8875fdf93f703bd9174a3d7e59dc77 /src/privsep-bpf.c | |
| parent | 1608a3170735cc697625b2d472286ba95fc88a91 (diff) | |
| download | dhcpcd-8ec63e6a621b7f027121a31478450698641b84ba.tar.xz | |
privsep: Implement pledge(2) support as found on OpenBSD
Diffstat (limited to 'src/privsep-bpf.c')
| -rw-r--r-- | src/privsep-bpf.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/src/privsep-bpf.c b/src/privsep-bpf.c index b1ed821d..fd76576c 100644 --- a/src/privsep-bpf.c +++ b/src/privsep-bpf.c @@ -203,6 +203,7 @@ ps_bpf_cmd(struct dhcpcd_ctx *ctx, struct ps_msghdr *psm, struct msghdr *msg) struct iovec *iov = msg->msg_iov; struct interface *ifp; struct ipv4_state *istate; + unsigned int flags = PSF_DROPPRIVS | PSF_CAP_ENTER; cmd = (uint8_t)(psm->ps_cmd & ~(PS_START | PS_STOP)); psp = ps_findprocess(ctx, &psm->ps_id); @@ -256,12 +257,19 @@ ps_bpf_cmd(struct dhcpcd_ctx *ctx, struct ps_msghdr *psm, struct msghdr *msg) psp->psp_proto = ETHERTYPE_ARP; psp->psp_protostr = "ARP"; psp->psp_filter = bpf_arp; + /* + * Pledge is currently useless for BPF ARP because we cannot + * change the filter: + * http://openbsd-archive.7691.n7.nabble.com/ \ + * pledge-bpf-32bit-arch-unbreak-td299901.html + */ break; #endif case PS_BPF_BOOTP: psp->psp_proto = ETHERTYPE_IP; psp->psp_protostr = "BOOTP"; psp->psp_filter = bpf_bootp; + flags |= PSF_PLEDGE; break; } @@ -269,7 +277,7 @@ ps_bpf_cmd(struct dhcpcd_ctx *ctx, struct ps_msghdr *psm, struct msghdr *msg) &psp->psp_pid, &psp->psp_fd, ps_bpf_recvmsg, NULL, psp, ps_bpf_start_bpf, ps_bpf_signal_bpfcb, - PSF_DROPPRIVS | PSF_CAP_ENTER); + flags); switch (start) { case -1: ps_freeprocess(psp); |