MFC: Add a temporary patch to remove tmppath from pledge in favour of
unveil(_PATH_TMP)+pledge("rpath wpath cpath").
Original commit from martijn@ (maintainer), OK op@ kirill@
delete pledge_sysctl() printing of the failing mibs, because it truncates
it's buffer, produces misleading output, and is pointless tty output,
Like with other system calls failuress, the standard pledge_fail() tty output
should lead the user to use ktrace which will provide an accurate view.
from deraadt@; discussed with bluhm
this is errata/7.7/022_pledge_sysctl.patch.sig
delete pledge_sysctl() printing of the failing mibs, because it truncates
it's buffer, produces misleading output, and is pointless tty output,
Like with other system calls failuress, the standard pledge_fail() tty output
should lead the user to use ktrace which will provide an accurate view.
from deraadt@; discussed with bluhm
this is errata/7.8/016_pledge_sysctl.patch.sig
replace pledge "stdio rpath tmppath" with unveil "/tmp" "rwc" to satisfy
mktemp(3) type operations, unveil "/" "r" for reading all over the tree,
and pledge "stdio rpath wpath cpath" to permit both unveils subject to
their own limitations.
pledge "rpath tmppath" is replace with unveil "/" "r", unveil "/tmp" "rwc",
and "rpath wpath cpath"
from deraadt@; ok semarie
This was using pledge "tmppath" with "rpath wpath cpath".
The "tmppath" is not needed.
from deraadt@; ok semarie and others
uses tmpfile(), which is why it used "tmppath", which is why it now
needs "rpath wpath cpath"
from deraadt@; spotted by brynet
Instead of pledge "tmppath rpath", setup a "rwc" unveil on "/tmp", a
"r" unveil on "/", and then pledge "rpath wpath cpath".
[28 lines not shown]
replace pledge "stdio rpath tmppath" with unveil "/tmp" "rwc" to satisfy
mktemp(3) type operations, unveil "/" "r" for reading all over the tree,
and pledge "stdio rpath wpath cpath" to permit both unveils subject to
their own limitations.
pledge "rpath tmppath" is replace with unveil "/" "r", unveil "/tmp" "rwc",
and "rpath wpath cpath"
from deraadt@; ok semarie
This was using pledge "tmppath" with "rpath wpath cpath".
The "tmppath" is not needed.
from deraadt@; ok semarie and others
uses tmpfile(), which is why it used "tmppath", which is why it now
needs "rpath wpath cpath"
from deraadt@; spotted by brynet
Instead of pledge "tmppath rpath", setup a "rwc" unveil on "/tmp", a
"r" unveil on "/", and then pledge "rpath wpath cpath".
[28 lines not shown]
Update for gnupg to 2.5.18
a crafted CMS (S/MIME) EnvelopedData message
carrying an oversized wrapped session key can
cause a stack-based buffer overflow in gpg-agent
during PKDECRYPT--kem=CMS handling
https://dev.gnupg.org/T8044https://dev.gnupg.org/T8049
OK jca@ (maintainer)
