Make Solaris privs code build on older systems.

Not all systems with Solaris privs have priv_basicset so factor that
out and provide backward compatibility code.  Similarly, not all have
PRIV_NET_ACCESS so wrap that in #ifdef.  Based on code from
alex at cooperi.net and djm@ with help from carson at taltos.org and
wieland at purdue.edu.

1 files changed, 5 insertions, 4 deletions

diff --git a/sandbox-solaris.c b/sandbox-solaris.c
index 98714e170..343a01022 100644
--- a/sandbox-solaris.c
+++ b/sandbox-solaris.c
@@ -48,19 +48,20 @@ ssh_sandbox_init(struct monitor *monitor)
         struct ssh_sandbox *box = NULL;
 
         box = xcalloc(1, sizeof(*box));
-        box->pset = priv_allocset();
+
+        /* Start with "basic" and drop everything we don't need. */
+        box->pset = solaris_basic_privset();
 
         if (box->pset == NULL) {
                 free(box);
                 return NULL;
         }
 
-        /* Start with "basic" and drop everything we don't need. */
-        priv_basicset(box->pset);
-
         /* Drop everything except the ability to use already-opened files */
         if (priv_delset(box->pset, PRIV_FILE_LINK_ANY) != 0 ||
+#ifdef PRIV_NET_ACCESS
             priv_delset(box->pset, PRIV_NET_ACCESS) != 0 ||
+#endif
             priv_delset(box->pset, PRIV_PROC_EXEC) != 0 ||
             priv_delset(box->pset, PRIV_PROC_FORK) != 0 ||
             priv_delset(box->pset, PRIV_PROC_INFO) != 0 ||