|
Lines 87-95
ssh_sandbox_child(struct ssh_sandbox *box)
Link Here
|
| 87 |
if (cap_rights_limit(STDIN_FILENO, &rights) < 0 && errno != ENOSYS) |
87 |
if (cap_rights_limit(STDIN_FILENO, &rights) < 0 && errno != ENOSYS) |
| 88 |
fatal("can't limit stdin: %m"); |
88 |
fatal("can't limit stdin: %m"); |
| 89 |
if (cap_rights_limit(STDOUT_FILENO, &rights) < 0 && errno != ENOSYS) |
89 |
if (cap_rights_limit(STDOUT_FILENO, &rights) < 0 && errno != ENOSYS) |
| 90 |
fatal("can't limit stdin: %m"); |
90 |
fatal("can't limit stdout: %m"); |
| 91 |
if (cap_rights_limit(STDERR_FILENO, &rights) < 0 && errno != ENOSYS) |
91 |
if (cap_rights_limit(STDERR_FILENO, &rights) < 0 && errno != ENOSYS) |
| 92 |
fatal("can't limit stdin: %m"); |
92 |
fatal("can't limit stderr: %m"); |
| 93 |
|
93 |
|
| 94 |
cap_rights_init(&rights, CAP_READ, CAP_WRITE); |
94 |
cap_rights_init(&rights, CAP_READ, CAP_WRITE); |
| 95 |
if (cap_rights_limit(box->monitor->m_recvfd, &rights) == -1) |
95 |
if (cap_rights_limit(box->monitor->m_recvfd, &rights) == -1) |
|
Lines 97-103
ssh_sandbox_child(struct ssh_sandbox *box)
Link Here
|
| 97 |
cap_rights_init(&rights, CAP_WRITE); |
97 |
cap_rights_init(&rights, CAP_WRITE); |
| 98 |
if (cap_rights_limit(box->monitor->m_log_sendfd, &rights) == -1) |
98 |
if (cap_rights_limit(box->monitor->m_log_sendfd, &rights) == -1) |
| 99 |
fatal("%s: failed to limit the logging socket", __func__); |
99 |
fatal("%s: failed to limit the logging socket", __func__); |
| 100 |
if (cap_enter() != 0 && errno != ENOSYS) |
100 |
if (cap_enter() < 0 && errno != ENOSYS) |
| 101 |
fatal("%s: failed to enter capability mode", __func__); |
101 |
fatal("%s: failed to enter capability mode", __func__); |
| 102 |
|
102 |
|
| 103 |
} |
103 |
} |