Because pledge(2) does not allow us to pass directory file descriptors

around, we can't use file descriptors for the working directory because
we will be unable to pass it to a privileged process to tell it where to
read or write files or spawn children. So move tmux back to using
strings for the current working directory. We try to check it exists
with access() when it is set but ultimately fall back to ~ if it fails
at time of use (or / if that fails too).

1 files changed, 10 insertions, 6 deletions

diff --git a/usr.bin/tmux/server-client.c b/usr.bin/tmux/server-client.c
index 76ff5e04da2..25d214fb2d7 100644
--- a/usr.bin/tmux/server-client.c
+++ b/usr.bin/tmux/server-client.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: server-client.c,v 1.164 2015/10/28 09:51:55 nicm Exp $ */
+/* $OpenBSD: server-client.c,v 1.165 2015/10/31 08:13:58 nicm Exp $ */
 
 /*
  * Copyright (c) 2009 Nicholas Marriott <nicm@users.sourceforge.net>
@@ -98,7 +98,7 @@ server_client_create(int fd)
 	c->environ = environ_create();
 
 	c->fd = -1;
-	c->cwd = -1;
+	c->cwd = NULL;
 
 	c->cmdq = cmdq_new(c);
 	c->cmdq->client_exit = 1;
@@ -194,7 +194,7 @@ server_client_lost(struct client *c)
 	screen_free(&c->status);
 
 	free(c->title);
-	close(c->cwd);
+	free((void *)c->cwd);
 
 	evtimer_del(&c->repeat_timer);
 
@@ -1099,7 +1099,7 @@ error:
 void
 server_client_dispatch_identify(struct client *c, struct imsg *imsg)
 {
-	const char	*data;
+	const char	*data, *home;
 	size_t	 	 datalen;
 	int		 flags;
 
@@ -1132,8 +1132,12 @@ server_client_dispatch_identify(struct client *c, struct imsg *imsg)
 	case MSG_IDENTIFY_CWD:
 		if (datalen == 0 || data[datalen - 1] != '\0')
 			fatalx("bad MSG_IDENTIFY_CWD string");
-		if ((c->cwd = open(data, O_RDONLY)) == -1)
-			c->cwd = open("/", O_RDONLY);
+		if (access(data, X_OK) == 0)
+			c->cwd = xstrdup(data);
+		else if ((home = find_home()) != NULL)
+			c->cwd = xstrdup(home);
+		else
+			c->cwd = xstrdup("/");
 		log_debug("client %p IDENTIFY_CWD %s", c, data);
 		break;
 	case MSG_IDENTIFY_STDIN: