svn commit: r252630 - head/sbin/dhclient

[Pawel Jakub Dawidek]

Author: pjd
Date: Wed Jul  3 22:18:40 2013
New Revision: 252630
URL: http://svnweb.freebsd.org/changeset/base/252630

Log:
  MFp4 @229484:
  
  Limit routing socket so only poll(2) and read(2) are allowed (CAP_POLL_EVENT
  and CAP_READ). This prevents unprivileged process from adding, removing or
  modifying system routes.
  
  Reviewed by:	brooks
  Sponsored by:	The FreeBSD Foundation

Modified:
  head/sbin/dhclient/dhclient.c

Modified: head/sbin/dhclient/dhclient.c
==============================================================================
--- head/sbin/dhclient/dhclient.c	Wed Jul  3 22:17:29 2013	(r252629)
+++ head/sbin/dhclient/dhclient.c	Wed Jul  3 22:18:40 2013	(r252630)
@@ -492,6 +492,10 @@ main(int argc, char *argv[])
 		add_protocol("AF_ROUTE", routefd, routehandler, ifi);
 	if (shutdown(routefd, SHUT_WR) < 0)
 		error("can't shutdown route socket: %m");
+	if (cap_rights_limit(routefd, CAP_POLL_EVENT | CAP_READ) < 0 &&
+	    errno != ENOSYS) {
+		error("can't limit route socket: %m");
+	}
 
 	if (chroot(_PATH_VAREMPTY) == -1)
 		error("chroot");