From: deraadt <deraadt@openbsd.org>
Date: Wed, 8 Aug 2018 22:56:42 +0000 (+0000)
Subject: ntpd unveils the cert.pem "r" file (which is passed-over-socket to the
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=01a880815432385c2737e6fe533dc24b973ac05f;p=openbsd

ntpd unveils the cert.pem "r" file (which is passed-over-socket to the
constraints process), and /usr/sbin/ntpd "x" to perform fork+exec operations.
---

diff --git a/usr.sbin/ntpd/ntpd.c b/usr.sbin/ntpd/ntpd.c
index 664fff4b2b6..cb6bc137082 100644
--- a/usr.sbin/ntpd/ntpd.c
+++ b/usr.sbin/ntpd/ntpd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ntpd.c,v 1.115 2018/08/04 11:07:14 mestre Exp $ */
+/*	$OpenBSD: ntpd.c,v 1.116 2018/08/08 22:56:42 deraadt Exp $ */
 
 /*
  * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
@@ -244,6 +244,10 @@ main(int argc, char *argv[])
 	 * Constraint processes are forked with certificates in memory,
 	 * then privdrop into chroot before speaking to the outside world.
 	 */
+	if (unveil("/etc/ssl/cert.pem", "r") == -1)
+		err(1, "unveil");
+	if (unveil("/usr/sbin/ntpd", "x") == -1)
+		err(1, "unveil");
 	if (pledge("stdio rpath inet settime proc exec id", NULL) == -1)
 		err(1, "pledge");