From owner-svn-src-user@freebsd.org Sat Mar 4 22:24:00 2017 Return-Path: Delivered-To: svn-src-user@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 93765CF9AE2 for ; Sat, 4 Mar 2017 22:24:00 +0000 (UTC) (envelope-from bapt@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 6E21D1D56; Sat, 4 Mar 2017 22:24:00 +0000 (UTC) (envelope-from bapt@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id v24MNxod004833; Sat, 4 Mar 2017 22:23:59 GMT (envelope-from bapt@FreeBSD.org) Received: (from bapt@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id v24MNx71004831; Sat, 4 Mar 2017 22:23:59 GMT (envelope-from bapt@FreeBSD.org) Message-Id: <201703042223.v24MNx71004831@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: bapt set sender to bapt@FreeBSD.org using -f From: Baptiste Daroussin Date: Sat, 4 Mar 2017 22:23:59 +0000 (UTC) To: src-committers@freebsd.org, svn-src-user@freebsd.org Subject: svn commit: r314684 - user/bapt/diff X-SVN-Group: user MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-user@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "SVN commit messages for the experimental " user" src tree" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 04 Mar 2017 22:24:00 -0000 Author: bapt Date: Sat Mar 4 22:23:59 2017 New Revision: 314684 URL: https://svnweb.freebsd.org/changeset/base/314684 Log: Only capsicumize in case of direct call to direct files For now diffing directories is not capsicumized as it needs more work Modified: user/bapt/diff/diff.c user/bapt/diff/diffdir.c user/bapt/diff/diffreg.c Modified: user/bapt/diff/diff.c ============================================================================== --- user/bapt/diff/diff.c Sat Mar 4 22:15:32 2017 (r314683) +++ user/bapt/diff/diff.c Sat Mar 4 22:23:59 2017 (r314684) @@ -307,8 +307,8 @@ main(int argc, char **argv) if (stat(argv[1], &stb2) < 0) err(2, "%s", argv[1]); } - print_status(diffreg(argv[0], argv[1], dflags), argv[0], argv[1], - ""); + print_status(diffreg(argv[0], argv[1], dflags, 1), argv[0], + argv[1], ""); } exit(status); } Modified: user/bapt/diff/diffdir.c ============================================================================== --- user/bapt/diff/diffdir.c Sat Mar 4 22:15:32 2017 (r314683) +++ user/bapt/diff/diffdir.c Sat Mar 4 22:23:59 2017 (r314684) @@ -207,7 +207,7 @@ diffit(struct dirent *dp, char *path1, s else if (!S_ISREG(stb2.st_mode) && !S_ISDIR(stb2.st_mode)) dp->d_status = D_SKIPPED2; else - dp->d_status = diffreg(path1, path2, flags); + dp->d_status = diffreg(path1, path2, flags, 0); print_status(dp->d_status, path1, path2, ""); } Modified: user/bapt/diff/diffreg.c ============================================================================== --- user/bapt/diff/diffreg.c Sat Mar 4 22:15:32 2017 (r314683) +++ user/bapt/diff/diffreg.c Sat Mar 4 22:23:59 2017 (r314684) @@ -306,7 +306,7 @@ static u_char cup2low[256] = { }; int -diffreg(char *file1, char *file2, int flags) +diffreg(char *file1, char *file2, int flags, int capsicum) { FILE *f1, *f2; int i, rval; @@ -405,23 +405,25 @@ diffreg(char *file1, char *file2, int fl } } - cap_rights_init(&rights_ro, CAP_READ, CAP_FSTAT, CAP_SEEK); - if (cap_rights_limit(fileno(f1), &rights_ro) < 0) - err(2, "unable to limit rights on: %s", file1); - if (cap_rights_limit(fileno(f2), &rights_ro) < 0) - err(2, "unable to limit rights on: %s", file2); - if (fileno(f1) == STDIN_FILENO || fileno(f2) == STDIN_FILENO) { - /* stding has already been limited */ - if (caph_limit_stderr() == -1) - err(2, "unable to limit stderr"); - if (caph_limit_stdout() == -1) - err(2, "unable to limit stdout"); - } else if (caph_limit_stdio() == -1) - err(2, "unable to limit stdio"); - - caph_cache_catpages(); - if (cap_enter() < 0 && errno != ENOSYS) - err(2, "unable to enter capability mode"); + if (capsicum) { + cap_rights_init(&rights_ro, CAP_READ, CAP_FSTAT, CAP_SEEK); + if (cap_rights_limit(fileno(f1), &rights_ro) < 0) + err(2, "unable to limit rights on: %s", file1); + if (cap_rights_limit(fileno(f2), &rights_ro) < 0) + err(2, "unable to limit rights on: %s", file2); + if (fileno(f1) == STDIN_FILENO || fileno(f2) == STDIN_FILENO) { + /* stding has already been limited */ + if (caph_limit_stderr() == -1) + err(2, "unable to limit stderr"); + if (caph_limit_stdout() == -1) + err(2, "unable to limit stdout"); + } else if (caph_limit_stdio() == -1) + err(2, "unable to limit stdio"); + + caph_cache_catpages(); + if (cap_enter() < 0 && errno != ENOSYS) + err(2, "unable to enter capability mode"); + } switch (files_differ(f1, f2, flags)) { case 0: