Regarding previous commit, X_OK on unveil-permitted directories does

not map nicely to UNVEIL_EXEC.  But we don't know before calling
namei() if the path is a directory.  Oh well, stick to UNVEIL_READ
for that case, it is going to be good enough for the typical case.
Worked out with jeremy after chrome/firefox Downloads directory issue.

diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c
index 6e1eb2d..33dab14 100644 (file)
--- a/sys/kern/vfs_syscalls.c
+++ b/sys/kern/vfs_syscalls.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: vfs_syscalls.c,v 1.367 2024/08/31 15:52:09 deraadt Exp $      */
+/*     $OpenBSD: vfs_syscalls.c,v 1.368 2024/09/01 23:26:10 deraadt Exp $      */
 /*     $NetBSD: vfs_syscalls.c,v 1.71 1996/04/23 10:29:02 mycroft Exp $        */
 
 /*
@@ -2002,10 +2002,8 @@ dofaccessat(struct proc *p, int fd, const char *path, int amode, int flag)
                vflags |= VWRITE;
                nd.ni_unveil |= UNVEIL_WRITE;
        }
-       if (amode & X_OK) {
+       if (amode & X_OK)
                vflags |= VEXEC;
-               nd.ni_unveil |= UNVEIL_EXEC;
-       }
        if ((error = namei(&nd)) != 0)
                goto out;
        vp = nd.ni_vp;