From 0064a5b36dbbcd94ad14338e1110072a209f9882 Mon Sep 17 00:00:00 2001 From: Baptiste Daroussin Date: Wed, 22 Feb 2017 16:37:45 +0000 Subject: [PATCH] Better fix for r314098 The actual issue was the fact that if - was used then some restriction were already set to stdin when we were applying caph_limit_stdio which was failing due to the fact the fd was the fd was already restricted to lower rights. Restricting stdio before actually opening the files prevent trying to raise the right and fixes the issue. And this allows to keep failing the program if restriction failed Approved by: allanjude Differential Revision: https://reviews.freebsd.org/D9723 --- usr.bin/lam/lam.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/usr.bin/lam/lam.c b/usr.bin/lam/lam.c index 46708742354a..f47115503f24 100644 --- a/usr.bin/lam/lam.c +++ b/usr.bin/lam/lam.c @@ -86,6 +86,8 @@ main(int argc, char *argv[]) if (argc == 1) usage(); + if (caph_limit_stdio() == -1) + err(1, "unable to limit stdio"); getargs(argv); if (!morefiles) usage(); @@ -95,7 +97,6 @@ main(int argc, char *argv[]) * mode. */ caph_cache_catpages(); - caph_limit_stdio(); if (cap_enter() < 0 && errno != ENOSYS) err(1, "unable to enter capability mode");