IABSD.fr/src/usr.sbin/ldpd

Branch : - branch - master - tag -

• Show log

  Commit

• Author : mestre
  Date : 2019-08-10 01:30:53
  Hash : 44e5c375
  Message : Like we did on other daemons that cannot be pledged due to forbidden ioctls the main process can be unveiled to restrict filesystem access. In this case we can restrict it to only read, although it must be the entire / since the daemon is able to include config files from anywhere. Additionally the ldpe process currently has cpath promise to unlink the socket, nevertheless the socket is actually unlinked from the main proc so this permission can be removed. As we discussed before, leaving the socket behind doesn't do any harm that's why I didn't unveil it in the main proc. OK deraadt@

• Files
• Makefile
• accept.c
• address.c
• adjacency.c
• control.c
• control.h
• hello.c
• init.c
• interface.c
• keepalive.c
• kroute.c
• l2vpn.c
• labelmapping.c
• lde.c
• lde.h
• lde_lib.c
• ldp.h
• ldpd.8
• ldpd.c
• ldpd.conf.5
• ldpd.h
• ldpe.c
• ldpe.h
• log.c
• log.h
• logmsg.c
• neighbor.c
• notification.c
• packet.c
• parse.y
• pfkey.c
• printconf.c
• socket.c
• util.c