unveil(2) /etc/nologin.txt for reading

ok deraadt

diff --git a/sbin/nologin/nologin.c b/sbin/nologin/nologin.c
index a01f421..15875cc 100644 (file)
--- a/sbin/nologin/nologin.c
+++ b/sbin/nologin/nologin.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: nologin.c,v 1.6 2015/10/13 07:10:38 doug Exp $        */
+/*     $OpenBSD: nologin.c,v 1.7 2018/08/14 18:13:11 cheloha Exp $     */
 
 /*
  * Copyright (c) 1997, Jason Downs.  All rights reserved.
@@ -46,6 +46,8 @@ main(int argc, char *argv[])
        ssize_t nrd;
        char nbuf[BUFSIZ];
 
+       if (unveil(_PATH_NOLOGIN_TXT, "r") == -1)
+               err(1, "unveil");
        if (pledge("stdio rpath", NULL) == -1)
                err(1, "pledge");