From 64e16a717d60d07e8b3d3342ff8f7486cc3c3140 Mon Sep 17 00:00:00 2001 From: doug Date: Fri, 16 Oct 2015 05:55:23 +0000 Subject: [PATCH] Pledge support for the parent/resolver in identd(8). This limits the resolver to just "stdio getpw" or "stdio getpw rpath" depending on whether ~/.noident files are checked. The child/listener cannot use pledge yet because it calls a sysctl that hasn't been whitelisted. "commit" deraadt@ --- usr.sbin/identd/identd.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/usr.sbin/identd/identd.c b/usr.sbin/identd/identd.c index 2540844b673..57a8500b236 100644 --- a/usr.sbin/identd/identd.c +++ b/usr.sbin/identd/identd.c @@ -1,4 +1,4 @@ -/* $OpenBSD: identd.c,v 1.31 2015/08/20 11:06:35 dlg Exp $ */ +/* $OpenBSD: identd.c,v 1.32 2015/10/16 05:55:23 doug Exp $ */ /* * Copyright (c) 2013 David Gwynne @@ -314,6 +314,9 @@ main(int argc, char *argv[]) lerr(1, "signal(SIGPIPE)"); if (parent) { + if (pledge("stdio proc getpw rpath", NULL) == -1) + err(1, "pledge"); + SIMPLEQ_INIT(&sc.parent.replies); event_set(&proc_rd, sibling, EV_READ | EV_PERSIST, @@ -343,6 +346,16 @@ main(int argc, char *argv[]) setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid)) lerr(1, "unable to revoke privs"); + if (parent) { + if (noident) { + if (pledge("stdio getpw rpath", NULL) == -1) + err(1, "pledge"); + } else { + if (pledge("stdio getpw", NULL) == -1) + err(1, "pledge"); + } + } + event_add(&proc_rd, NULL); event_dispatch(); return (0); -- 2.20.1