Date: Tue, 16 Apr 2019 04:12:42 +0000 (UTC) From: Mariusz Zaborski <oshogbo@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r346263 - head/contrib/tcpdump Message-ID: <201904160412.x3G4CgN2015092@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: oshogbo Date: Tue Apr 16 04:12:41 2019 New Revision: 346263 URL: https://svnweb.freebsd.org/changeset/base/346263 Log: tcpdump: disable Capsicum if -E option is provided. The -E is used to provide a secret for decrypting IPsec. The secret may be provided through command line or as the file. The problem is that tcpdump doesn't support yet opening files in capability mode and the file may contain a list of the files to open. As a workaround, for now, let's just disable capsicum if the -E the option is provided. PR: 236819 MFC after: 2 weeks Modified: head/contrib/tcpdump/tcpdump.c Modified: head/contrib/tcpdump/tcpdump.c ============================================================================== --- head/contrib/tcpdump/tcpdump.c Tue Apr 16 02:48:04 2019 (r346262) +++ head/contrib/tcpdump/tcpdump.c Tue Apr 16 04:12:41 2019 (r346263) @@ -2063,7 +2063,8 @@ main(int argc, char **argv) } #ifdef HAVE_CAPSICUM - cansandbox = (VFileName == NULL && zflag == NULL); + cansandbox = (VFileName == NULL && zflag == NULL && + ndo->ndo_espsecret == NULL); #ifdef HAVE_CASPER cansandbox = (cansandbox && (ndo->ndo_nflag || capdns != NULL)); #else
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201904160412.x3G4CgN2015092>