Allow running in single user mode where /var/empty doesn't exist by

switching from chroot("/var/empty") to unveil("/", "").
This is just an extra pair of suspenders since these processes
pledge(2) to not access the filesystem.
OK deraadt

diff --git a/sbin/dhcpleased/engine.c b/sbin/dhcpleased/engine.c
index 03d8e92..badd7c7 100644 (file)
--- a/sbin/dhcpleased/engine.c
+++ b/sbin/dhcpleased/engine.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: engine.c,v 1.13 2021/04/14 23:35:24 deraadt Exp $     */
+/*     $OpenBSD: engine.c,v 1.14 2021/05/01 11:51:59 florian Exp $     */
 
 /*
  * Copyright (c) 2017, 2021 Florian Obser <florian@openbsd.org>
@@ -173,11 +173,14 @@ engine(int debug, int verbose)
        if ((pw = getpwnam(DHCPLEASED_USER)) == NULL)
                fatal("getpwnam");
 
-       if (chroot(pw->pw_dir) == -1)
-               fatal("chroot");
        if (chdir("/") == -1)
                fatal("chdir(\"/\")");
 
+       if (unveil("/", "") == -1)
+               fatal("unveil(\"/\", \"\")");
+       if (unveil(NULL, NULL) == -1)
+               fatal("unveil(NULL, NULL)");
+
        setproctitle("%s", "engine");
        log_procinit("engine");
 

diff --git a/sbin/dhcpleased/frontend.c b/sbin/dhcpleased/frontend.c
index e6ee7fd..79e69f9 100644 (file)
--- a/sbin/dhcpleased/frontend.c
+++ b/sbin/dhcpleased/frontend.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: frontend.c,v 1.10 2021/04/14 23:35:24 deraadt Exp $   */
+/*     $OpenBSD: frontend.c,v 1.11 2021/05/01 11:51:59 florian Exp $   */
 
 /*
  * Copyright (c) 2017, 2021 Florian Obser <florian@openbsd.org>
@@ -134,11 +134,14 @@ frontend(int debug, int verbose)
        if ((pw = getpwnam(DHCPLEASED_USER)) == NULL)
                fatal("getpwnam");
 
-       if (chroot(pw->pw_dir) == -1)
-               fatal("chroot");
        if (chdir("/") == -1)
                fatal("chdir(\"/\")");
 
+       if (unveil("/", "") == -1)
+               fatal("unveil(\"/\", \"\")");
+       if (unveil(NULL, NULL) == -1)
+               fatal("unveil(NULL, NULL)");
+
        setproctitle("%s", "frontend");
        log_procinit("frontend");