PERFORCE change 163824 for review
Robert Watson
rwatson at FreeBSD.org
Mon Jun 8 20:06:13 UTC 2009
http://perforce.freebsd.org/chv.cgi?CH=163824
Change 163824 by rwatson at rwatson_freebsd_capabilities on 2009/06/08 20:05:36
As a supplement to existing ad hoc sandboxing techniques in
sshd's privilege separation, also employ a capability mode
sandbox if supported by the kernel.
Affected files ...
.. //depot/projects/trustedbsd/capabilities/src/crypto/openssh/sshd.c#5 edit
Differences ...
==== //depot/projects/trustedbsd/capabilities/src/crypto/openssh/sshd.c#5 (text+ko) ====
@@ -46,6 +46,7 @@
__RCSID("$FreeBSD: src/crypto/openssh/sshd.c,v 1.48 2009/05/22 18:46:28 des Exp $");
#include <sys/types.h>
+#include <sys/capability.h>
#include <sys/ioctl.h>
#include <sys/socket.h>
#ifdef HAVE_SYS_STAT_H
@@ -620,6 +621,8 @@
fatal("setgroups: %.100s", strerror(errno));
permanently_set_uid(privsep_pw);
#endif
+ if (cap_enter() != 0 && errno != ENOSYS)
+ fatal("cap_enter: %.100s", strerror(errno));
}
static int
More information about the p4-projects
mailing list