From bfcef0862b80be7e33f3b259f0aa768556063cf3 Mon Sep 17 00:00:00 2001 From: deraadt Date: Tue, 26 Jul 2022 14:53:29 +0000 Subject: [PATCH] Only allow changing the domainname (from empty) before securelevel increase. libc YP support has a couple of places where the domainname is cached, and this results in wildly incoherent behaviour which could even be risky. If you want to change the domainname, you will have to reboot. ok beck miod --- lib/libc/gen/getdomainname.3 | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/lib/libc/gen/getdomainname.3 b/lib/libc/gen/getdomainname.3 index 2b982311bf0..1eef9433d3f 100644 --- a/lib/libc/gen/getdomainname.3 +++ b/lib/libc/gen/getdomainname.3 @@ -1,4 +1,4 @@ -.\" $OpenBSD: getdomainname.3,v 1.28 2022/07/17 08:33:01 jsg Exp $ +.\" $OpenBSD: getdomainname.3,v 1.29 2022/07/26 14:53:29 deraadt Exp $ .\" .\" Copyright (c) 1983, 1991, 1993 .\" The Regents of the University of California. All rights reserved. @@ -27,7 +27,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd $Mdocdate: July 17 2022 $ +.Dd $Mdocdate: July 26 2022 $ .Dt GETDOMAINNAME 3 .Os .Sh NAME @@ -61,6 +61,8 @@ which has length .Fa namelen . This call is restricted to the superuser and is normally used only when the system is bootstrapped. +Under normal operation once the domainname is set, it cannot be +changed. .Sh RETURN VALUES If the call succeeds, a value of 0 is returned. If the call fails, a value of \-1 is returned and an error code is -- 2.20.1