From dfbc560190d6fc06b6aa3100845c71bb7ccef9e7 Mon Sep 17 00:00:00 2001 From: ray Date: Fri, 23 Jul 2010 03:13:51 +0000 Subject: [PATCH] Permit a few more syscalls for named to run. OK deraadt --- etc/systrace/usr_sbin_named | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/etc/systrace/usr_sbin_named b/etc/systrace/usr_sbin_named index 0e2f11a5422..2a0c4038207 100644 --- a/etc/systrace/usr_sbin_named +++ b/etc/systrace/usr_sbin_named @@ -1,4 +1,4 @@ -# $OpenBSD: usr_sbin_named,v 1.5 2004/05/13 04:50:04 sturm Exp $ +# $OpenBSD: usr_sbin_named,v 1.6 2010/07/23 03:13:51 ray Exp $ # # Policy for named that uses named user and chroots to /var/named # This policy works for the default configuration of named. @@ -28,6 +28,7 @@ Policy: /usr/sbin/named, Emulation: native native-fsread: filename eq "/etc/named.keys" then permit native-fsread: filename eq "/etc/pwd.db" then permit native-fsread: filename eq "/etc/rndc.key" then permit + native-fsread: filename eq "/etc/root.hint" then permit native-fsread: filename eq "/etc/spwd.db" then deny[eperm] native-fsread: filename match "/master" then permit native-fsread: filename match "/slave" then permit @@ -63,6 +64,7 @@ Policy: /usr/sbin/named, Emulation: native native-mquery: permit native-munmap: permit native-nanosleep: permit + native-pipe: permit native-pread: permit native-read: permit native-recvmsg: permit @@ -74,6 +76,8 @@ Policy: /usr/sbin/named, Emulation: native native-seteuid: uid eq "70" and uname eq "named" then permit native-setgid: gid eq "70" then permit native-setgroups: permit + native-setresgid: permit + native-setresuid: permit native-setrlimit: permit native-setsid: permit native-setsockopt: permit -- 2.20.1