From: florian <florian@openbsd.org>
Date: Sat, 1 May 2021 11:51:59 +0000 (+0000)
Subject: Allow running in single user mode where /var/empty doesn't exist by
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=c7d84514db404db5d2fb08d3760c13679ee3fdb1;p=openbsd

Allow running in single user mode where /var/empty doesn't exist by
switching from chroot("/var/empty") to unveil("/", "").
This is just an extra pair of suspenders since these processes
pledge(2) to not access the filesystem.
OK deraadt
---

diff --git a/sbin/dhcpleased/engine.c b/sbin/dhcpleased/engine.c
index 03d8e924cae..badd7c76709 100644
--- a/sbin/dhcpleased/engine.c
+++ b/sbin/dhcpleased/engine.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: engine.c,v 1.13 2021/04/14 23:35:24 deraadt Exp $	*/
+/*	$OpenBSD: engine.c,v 1.14 2021/05/01 11:51:59 florian Exp $	*/
 
 /*
  * Copyright (c) 2017, 2021 Florian Obser <florian@openbsd.org>
@@ -173,11 +173,14 @@ engine(int debug, int verbose)
 	if ((pw = getpwnam(DHCPLEASED_USER)) == NULL)
 		fatal("getpwnam");
 
-	if (chroot(pw->pw_dir) == -1)
-		fatal("chroot");
 	if (chdir("/") == -1)
 		fatal("chdir(\"/\")");
 
+	if (unveil("/", "") == -1)
+		fatal("unveil(\"/\", \"\")");
+	if (unveil(NULL, NULL) == -1)
+		fatal("unveil(NULL, NULL)");
+
 	setproctitle("%s", "engine");
 	log_procinit("engine");
 
diff --git a/sbin/dhcpleased/frontend.c b/sbin/dhcpleased/frontend.c
index e6ee7fdc4b9..79e69f9f25c 100644
--- a/sbin/dhcpleased/frontend.c
+++ b/sbin/dhcpleased/frontend.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: frontend.c,v 1.10 2021/04/14 23:35:24 deraadt Exp $	*/
+/*	$OpenBSD: frontend.c,v 1.11 2021/05/01 11:51:59 florian Exp $	*/
 
 /*
  * Copyright (c) 2017, 2021 Florian Obser <florian@openbsd.org>
@@ -134,11 +134,14 @@ frontend(int debug, int verbose)
 	if ((pw = getpwnam(DHCPLEASED_USER)) == NULL)
 		fatal("getpwnam");
 
-	if (chroot(pw->pw_dir) == -1)
-		fatal("chroot");
 	if (chdir("/") == -1)
 		fatal("chdir(\"/\")");
 
+	if (unveil("/", "") == -1)
+		fatal("unveil(\"/\", \"\")");
+	if (unveil(NULL, NULL) == -1)
+		fatal("unveil(NULL, NULL)");
+
 	setproctitle("%s", "frontend");
 	log_procinit("frontend");