diff options
| author | florian | 2015-11-05 19:15:22 +0000 |
|---|---|---|
| committer | Wynn Wolf Arbor | 2020-05-24 12:33:55 +0200 |
| commit | f3fe4ef0c9d8ed49e85673c9b97cae1d3257bc89 (patch) | |
| tree | d966d0dfe6e24daad1c9f320b1a857faff1c561e /slowcgi.c | |
| parent | 9b484f13cd9210c9b79f131c237a899ec20caef5 (diff) | |
| download | slowcgi-f3fe4ef0c9d8ed49e85673c9b97cae1d3257bc89.tar.gz | |
pledge(2) for slowcgi. After initialization slowcgi accepts from a AF_UNIX socket, forks and execs. After fork we only need to close(2), chdir(2) and exec. OK benno@
Diffstat (limited to 'slowcgi.c')
| -rw-r--r-- | slowcgi.c | 7 |
1 files changed, 6 insertions, 1 deletions
@@ -1,4 +1,4 @@ -/* $OpenBSD: slowcgi.c,v 1.46 2015/11/05 19:14:56 florian Exp $ */ +/* $OpenBSD: slowcgi.c,v 1.47 2015/11/05 19:15:22 florian Exp $ */ /* * Copyright (c) 2013 David Gwynne <dlg@openbsd.org> * Copyright (c) 2013 Florian Obser <florian@openbsd.org> @@ -336,6 +336,9 @@ main(int argc, char *argv[]) setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid)) lerr(1, "unable to revoke privs"); + if (pledge("stdio rpath unix proc exec", NULL) == -1) + lerr(1, "pledge"); + SLIST_INIT(&slowcgi_proc.requests); event_init(); @@ -883,6 +886,8 @@ exec_cgi(struct request *c) return; case 0: /* Child process */ + if (pledge("stdio rpath exec", NULL) == -1) + lerr(1, "pledge"); close(s_in[0]); close(s_out[0]); close(s_err[0]); |