hardenedbsd/HardenedBSD
1
0
Fork 0
mirror of https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git synced 2024-11-22 03:04:34 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Log a warning if we cannot sandbox using capsicum, but only under debug level 1.

Browse Source 
It would be too noisy to log it as a proper warning as CAPABILITIES are not
compiled into GENERIC by default.

MFC after:	3 days
This commit is contained in:
Pawel Jakub Dawidek 2011-06-27 09:10:48 +00:00
parent e1ab183c5e
commit 133d75ed18
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=223584
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
sbin/hastd/subr.c
View File

@ -230,9 +230,13 @@ drop_privs(struct hast_resource *res)
* ioctls and secondary uses ioctls to handle BIO_DELETE and BIO_FLUSH.
* For now capsicum is only used to sandbox hastctl.
*/
if (res == NULL)
if (res == NULL) {
capsicum = (cap_enter() == 0);
else
if (!capsicum) {
pjdlog_common(LOG_DEBUG, 1, errno,
"Unable to sandbox using capsicum");
}
} else
capsicum = false;
/*