diff options
-rw-r--r-- | ChangeLog | 5 | ||||
-rw-r--r-- | sandbox-capsicum.c | 6 |
2 files changed, 9 insertions, 2 deletions
@@ -1,3 +1,8 @@ | |||
1 | 20140205 | ||
2 | - (djm) [sandbox-capsicum.c] Don't fatal if Capsicum is offered by | ||
3 | headers/libc but not supported by the kernel. Patch from Loganaden | ||
4 | Velvindron @ AfriNIC | ||
5 | |||
1 | 20140204 | 6 | 20140204 |
2 | - OpenBSD CVS Sync | 7 | - OpenBSD CVS Sync |
3 | - markus@cvs.openbsd.org 2014/01/27 18:58:14 | 8 | - markus@cvs.openbsd.org 2014/01/27 18:58:14 |
diff --git a/sandbox-capsicum.c b/sandbox-capsicum.c index ee2a7e79e..655f0d217 100644 --- a/sandbox-capsicum.c +++ b/sandbox-capsicum.c | |||
@@ -94,10 +94,12 @@ ssh_sandbox_child(struct ssh_sandbox *box) | |||
94 | fatal("can't limit stderr: %m"); | 94 | fatal("can't limit stderr: %m"); |
95 | 95 | ||
96 | cap_rights_init(&rights, CAP_READ, CAP_WRITE); | 96 | cap_rights_init(&rights, CAP_READ, CAP_WRITE); |
97 | if (cap_rights_limit(box->monitor->m_recvfd, &rights) == -1) | 97 | if (cap_rights_limit(box->monitor->m_recvfd, &rights) < 0 && |
98 | errno != ENOSYS) | ||
98 | fatal("%s: failed to limit the network socket", __func__); | 99 | fatal("%s: failed to limit the network socket", __func__); |
99 | cap_rights_init(&rights, CAP_WRITE); | 100 | cap_rights_init(&rights, CAP_WRITE); |
100 | if (cap_rights_limit(box->monitor->m_log_sendfd, &rights) == -1) | 101 | if (cap_rights_limit(box->monitor->m_log_sendfd, &rights) < 0 && |
102 | errno != ENOSYS) | ||
101 | fatal("%s: failed to limit the logging socket", __func__); | 103 | fatal("%s: failed to limit the logging socket", __func__); |
102 | if (cap_enter() < 0 && errno != ENOSYS) | 104 | if (cap_enter() < 0 && errno != ENOSYS) |
103 | fatal("%s: failed to enter capability mode", __func__); | 105 | fatal("%s: failed to enter capability mode", __func__); |