Date: Mon, 8 Jun 2009 20:06:11 GMT From: Robert Watson <rwatson@FreeBSD.org> To: Perforce Change Reviews <perforce@freebsd.org> Subject: PERFORCE change 163824 for review Message-ID: <200906082006.n58K6B86013682@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
http://perforce.freebsd.org/chv.cgi?CH=163824 Change 163824 by rwatson@rwatson_freebsd_capabilities on 2009/06/08 20:05:36 As a supplement to existing ad hoc sandboxing techniques in sshd's privilege separation, also employ a capability mode sandbox if supported by the kernel. Affected files ... .. //depot/projects/trustedbsd/capabilities/src/crypto/openssh/sshd.c#5 edit Differences ... ==== //depot/projects/trustedbsd/capabilities/src/crypto/openssh/sshd.c#5 (text+ko) ==== @@ -46,6 +46,7 @@ __RCSID("$FreeBSD: src/crypto/openssh/sshd.c,v 1.48 2009/05/22 18:46:28 des Exp $"); #include <sys/types.h> +#include <sys/capability.h> #include <sys/ioctl.h> #include <sys/socket.h> #ifdef HAVE_SYS_STAT_H @@ -620,6 +621,8 @@ fatal("setgroups: %.100s", strerror(errno)); permanently_set_uid(privsep_pw); #endif + if (cap_enter() != 0 && errno != ENOSYS) + fatal("cap_enter: %.100s", strerror(errno)); } static int
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200906082006.n58K6B86013682>