Linux: make resource limits work by using getifaddrs over privsep

diff --git a/src/if.c b/src/if.c
index fd05bec40b984f3db4cb240dc1bceebf3eb19002..7ca538af5c2820f1c7c5afcaebc65263cfa470df 100644 (file)
--- a/src/if.c
+++ b/src/if.c
@@ -403,7 +403,7 @@ if_discover(struct dhcpcd_ctx *ctx, struct ifaddrs **ifaddrs,
        }
        TAILQ_INIT(ifs);
 
-#if defined(PRIVSEP) && defined(HAVE_CAPSICUM)
+#ifdef PRIVSEP_GETIFADDRS
        if (ctx->options & DHCPCD_PRIVSEP) {
                if (ps_root_getifaddrs(ctx, ifaddrs) == -1) {
                        logerr("ps_root_getifaddrs");

diff --git a/src/privsep-root.c b/src/privsep-root.c
index 512dfcc03720d7c2e369157c0bee8cc5b3f6176f..5f5e2861b188066aa86b147c6eda91d56e76f9cd 100644 (file)
--- a/src/privsep-root.c
+++ b/src/privsep-root.c
@@ -132,7 +132,7 @@ ps_root_readerror(struct dhcpcd_ctx *ctx, void *data, size_t len)
        return psr_ctx.psr_error.psr_result;
 }
 
-#ifdef HAVE_CAPSICUM
+#ifdef PRIVSEP_GETIFADDRS
 static void
 ps_root_mreaderrorcb(void *arg)
 {
@@ -351,7 +351,7 @@ ps_root_monordm(uint64_t *rdm, size_t len)
 }
 #endif
 
-#ifdef HAVE_CAPSICUM
+#ifdef PRIVSEP_GETIFADDRS
 #define        IFA_NADDRS      3
 static ssize_t
 ps_root_dogetifaddrs(void **rdata, size_t *rlen)
@@ -564,7 +564,7 @@ ps_root_recvmsgcb(void *arg, struct ps_msghdr *psm, struct msghdr *msg)
                }
                break;
 #endif
-#ifdef HAVE_CAPSICUM
+#ifdef PRIVSEP_GETIFADDRS
        case PS_GETIFADDRS:
                err = ps_root_dogetifaddrs(&rdata, &rlen);
                free_rdata = true;
@@ -889,7 +889,7 @@ ps_root_filemtime(struct dhcpcd_ctx *ctx, const char *file, time_t *time)
        return ps_root_readerror(ctx, time, sizeof(*time));
 }
 
-#ifdef HAVE_CAPSICUM
+#ifdef PRIVSEP_GETIFADDRS
 int
 ps_root_getifaddrs(struct dhcpcd_ctx *ctx, struct ifaddrs **ifahead)
 {
@@ -916,7 +916,7 @@ ps_root_getifaddrs(struct dhcpcd_ctx *ctx, struct ifaddrs **ifahead)
 
        bp = buf;
        *ifahead = (struct ifaddrs *)(void *)bp;
-       for (ifa = *ifahead; len != 0; ifa = ifa->ifa_next) {
+       for (ifa = *ifahead; ifa != NULL; ifa = ifa->ifa_next) {
                if (len < ALIGN(sizeof(*ifa)) +
                    ALIGN(IFNAMSIZ) + ALIGN(sizeof(salen) * IFA_NADDRS))
                        goto err;
@@ -944,9 +944,11 @@ ps_root_getifaddrs(struct dhcpcd_ctx *ctx, struct ifaddrs **ifahead)
                COPYOUTSA(ifa->ifa_addr);
                COPYOUTSA(ifa->ifa_netmask);
                COPYOUTSA(ifa->ifa_broadaddr);
-               ifa->ifa_next = (struct ifaddrs *)(void *)bp;
+               if (len != 0)
+                       ifa->ifa_next = (struct ifaddrs *)(void *)bp;
+               else
+                       ifa->ifa_next = NULL;
        }
-       ifa->ifa_next = NULL;
        return 0;
 
 err:

diff --git a/src/privsep-root.h b/src/privsep-root.h
index 371431bf2ef9f36dd3a09b157dd702cfc97632d5..1de284bf24cd86daff27474d9cbb68a6ae76dc75 100644 (file)
--- a/src/privsep-root.h
+++ b/src/privsep-root.h
@@ -31,6 +31,10 @@
 
 #include "if.h"
 
+#if defined(PRIVSEP) && (defined(HAVE_CAPSICUM) || defined(__linux__))
+#define PRIVSEP_GETIFADDRS
+#endif
+
 pid_t ps_root_start(struct dhcpcd_ctx *ctx);
 int ps_root_stop(struct dhcpcd_ctx *ctx);
 
@@ -45,7 +49,9 @@ ssize_t ps_root_writefile(struct dhcpcd_ctx *, const char *, mode_t,
     const void *, size_t);
 ssize_t ps_root_script(struct dhcpcd_ctx *, const void *, size_t);
 int ps_root_getauthrdm(struct dhcpcd_ctx *, uint64_t *);
+#ifdef PRIVSEP_GETIFADDRS
 int ps_root_getifaddrs(struct dhcpcd_ctx *, struct ifaddrs **);
+#endif
 
 ssize_t ps_root_os(struct ps_msghdr *, struct msghdr *, void **, size_t *);
 #if defined(BSD) || defined(__sun)

diff --git a/src/privsep.c b/src/privsep.c
index 8901746444fc6094de61ce0afc3a383f37ac599c..271c0c39e01b1da745a173681bfcb13ecc2f3df9 100644 (file)
--- a/src/privsep.c
+++ b/src/privsep.c
@@ -113,7 +113,7 @@ int
 ps_dropprivs(struct dhcpcd_ctx *ctx)
 {
        struct passwd *pw = ctx->ps_user;
-#if !defined(HAVE_PLEDGE) && !defined(__linux__)
+#if !defined(HAVE_PLEDGE)
        struct rlimit rzero = { .rlim_cur = 0, .rlim_max = 0 };
 #endif
 
@@ -132,16 +132,18 @@ ps_dropprivs(struct dhcpcd_ctx *ctx)
                return -1;
        }
 
-#if defined(HAVE_PLEDGE) || defined(__linux__)
+#if defined(HAVE_PLEDGE)
        /* None of these resource limits work with pledge. */
 #else
+#ifndef __linux__ /* breaks ppoll */
        /* Prohibit new files, sockets, etc */
        if (setrlimit(RLIMIT_NOFILE, &rzero) == -1) {
                logerr("setrlimit RLIMIT_NOFILE");
                return -1;
        }
+#endif
 
-#ifndef HAVE_CAPSICUM /* Seems to break our IPC. */
+#ifndef HAVE_CAPSICUM /* breaks sending over our IPC */
        /* Prohibit large files */
        if (setrlimit(RLIMIT_FSIZE, &rzero) == -1) {
                logerr("setrlimit RLIMIT_FSIZE");