Add nochroot parameter to module_drop_privilege() so that modules can

use unveil(2) instead of chroot(2) if need.

diff --git a/usr.sbin/radiusd/radiusd_bsdauth.c b/usr.sbin/radiusd/radiusd_bsdauth.c
index 69907bf..9f37ffa 100644 (file)
--- a/usr.sbin/radiusd/radiusd_bsdauth.c
+++ b/usr.sbin/radiusd/radiusd_bsdauth.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: radiusd_bsdauth.c,v 1.15 2023/08/18 06:12:27 yasuoka Exp $    */
+/*     $OpenBSD: radiusd_bsdauth.c,v 1.16 2024/02/09 07:41:32 yasuoka Exp $    */
 
 /*
  * Copyright (c) 2015 YASUOKA Masahiko <yasuoka@yasuoka.net>
@@ -247,7 +247,7 @@ module_bsdauth_main(void)
            &module_bsdauth_handlers)) == NULL)
                err(1, "Could not create a module instance");
 
-       module_drop_privilege(module_bsdauth.base);
+       module_drop_privilege(module_bsdauth.base, 0);
 
        module_load(module_bsdauth.base);
        imsg_init(&module_bsdauth.ibuf, 3);

diff --git a/usr.sbin/radiusd/radiusd_module.c b/usr.sbin/radiusd/radiusd_module.c
index 0b482a1..85236db 100644 (file)
--- a/usr.sbin/radiusd/radiusd_module.c
+++ b/usr.sbin/radiusd/radiusd_module.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: radiusd_module.c,v 1.15 2024/01/08 04:16:48 yasuoka Exp $     */
+/*     $OpenBSD: radiusd_module.c,v 1.16 2024/02/09 07:41:32 yasuoka Exp $     */
 
 /*
  * Copyright (c) 2015 YASUOKA Masahiko <yasuoka@yasuoka.net>
@@ -162,7 +162,7 @@ module_load(struct module_base *base)
 }
 
 void
-module_drop_privilege(struct module_base *base)
+module_drop_privilege(struct module_base *base, int nochroot)
 {
        struct passwd   *pw;
 
@@ -171,7 +171,7 @@ module_drop_privilege(struct module_base *base)
        /* Drop the privilege */
        if ((pw = getpwnam(RADIUSD_USER)) == NULL)
                goto on_fail;
-       if (chroot(pw->pw_dir) == -1)
+       if (nochroot == 0 && chroot(pw->pw_dir) == -1)
                goto on_fail;
        if (chdir("/") == -1)
                goto on_fail;

diff --git a/usr.sbin/radiusd/radiusd_module.h b/usr.sbin/radiusd/radiusd_module.h
index 6b993ad..5fb4451 100644 (file)
--- a/usr.sbin/radiusd/radiusd_module.h
+++ b/usr.sbin/radiusd/radiusd_module.h
@@ -60,7 +60,7 @@ void                   module_stop(struct module_base *);
 int                     module_run(struct module_base *);
 void                    module_destroy(struct module_base *);
 void                    module_load(struct module_base *);
-void                    module_drop_privilege(struct module_base *);
+void                    module_drop_privilege(struct module_base *, int);
 int                     module_notify_secret(struct module_base *,
                            const char *);
 int                     module_send_message(struct module_base *, uint32_t,

diff --git a/usr.sbin/radiusd/radiusd_radius.c b/usr.sbin/radiusd/radiusd_radius.c
index 3b3b67e..c0aa8f8 100644 (file)
--- a/usr.sbin/radiusd/radiusd_radius.c
+++ b/usr.sbin/radiusd/radiusd_radius.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: radiusd_radius.c,v 1.19 2023/09/04 10:49:20 yasuoka Exp $     */
+/*     $OpenBSD: radiusd_radius.c,v 1.20 2024/02/09 07:41:32 yasuoka Exp $     */
 
 /*
  * Copyright (c) 2013 Internet Initiative Japan Inc.
@@ -125,7 +125,7 @@ main(int argc, char *argv[])
        if ((module_radius.base = module_create(
            STDIN_FILENO, &module_radius, &module_radius_handlers)) == NULL)
                err(1, "Could not create a module instance");
-       module_drop_privilege(module_radius.base);
+       module_drop_privilege(module_radius.base, 0);
        setproctitle("[main]");
 
        module_load(module_radius.base);

diff --git a/usr.sbin/radiusd/radiusd_standard.c b/usr.sbin/radiusd/radiusd_standard.c
index 1157483..f819e3b 100644 (file)
--- a/usr.sbin/radiusd/radiusd_standard.c
+++ b/usr.sbin/radiusd/radiusd_standard.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: radiusd_standard.c,v 1.3 2024/02/06 10:53:20 yasuoka Exp $    */
+/*     $OpenBSD: radiusd_standard.c,v 1.4 2024/02/09 07:41:32 yasuoka Exp $    */
 
 /*
  * Copyright (c) 2013, 2023 Internet Initiative Japan Inc.
@@ -74,7 +74,7 @@ main(int argc, char *argv[])
            STDIN_FILENO, &module_standard, &handlers)) == NULL)
                err(1, "Could not create a module instance");
 
-       module_drop_privilege(module_standard.base);
+       module_drop_privilege(module_standard.base, 0);
        if (pledge("stdio", NULL) == -1)
                err(1, "pledge");