diff options
| author | Ted Unangst <tedu@cvs.openbsd.org> | 2022-02-04 17:50:29 +0000 |
|---|---|---|
| committer | Ted Unangst <tedu@cvs.openbsd.org> | 2022-02-04 17:50:29 +0000 |
| commit | 8548b5d82e20acf9fe013664d6e6cd5785c436c4 (patch) | |
| tree | cfe2ca82c2641bd8afdf1df50b47f72caac6d789 /sys | |
| parent | 369898e4ec243b2e4ee9224b8b8ddcdc3fa13b79 (diff) | |
whitelist resolv.conf for stat. go dns library does this.
ok deraadt
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/kern/kern_pledge.c | 17 |
1 files changed, 11 insertions, 6 deletions
diff --git a/sys/kern/kern_pledge.c b/sys/kern/kern_pledge.c index 6687bf91f09..b876b91a18a 100644 --- a/sys/kern/kern_pledge.c +++ b/sys/kern/kern_pledge.c @@ -1,4 +1,4 @@ -/* $OpenBSD: kern_pledge.c,v 1.278 2022/01/20 03:43:30 jsg Exp $ */ +/* $OpenBSD: kern_pledge.c,v 1.279 2022/02/04 17:50:28 tedu Exp $ */ /* * Copyright (c) 2015 Nicholas Marriott <nicm@openbsd.org> @@ -733,12 +733,17 @@ pledge_namei(struct proc *p, struct nameidata *ni, char *origpath) break; case SYS_stat: - /* DNS needs /etc/resolv.conf. */ + /* DNS needs /etc/{resolv.conf,hosts}. */ if ((ni->ni_pledge == PLEDGE_RPATH) && - (pledge & PLEDGE_DNS) && - strcmp(path, "/etc/resolv.conf") == 0) { - ni->ni_cnd.cn_flags |= BYPASSUNVEIL; - return (0); + (pledge & PLEDGE_DNS)) { + if (strcmp(path, "/etc/resolv.conf") == 0) { + ni->ni_cnd.cn_flags |= BYPASSUNVEIL; + return (0); + } + if (strcmp(path, "/etc/hosts") == 0) { + ni->ni_cnd.cn_flags |= BYPASSUNVEIL; + return (0); + } } break; } |