From e6895e80490be42c13efe6009373fa70391d0c96 Mon Sep 17 00:00:00 2001 From: Hans Petter Selasky Date: Wed, 12 Sep 2018 10:09:59 +0000 Subject: [PATCH] Fix for backends which doesn't support capsicum. Not all libpcap backends use the BPF compatible set of IOCTLs. For example the mlx5 backend uses libibverbs which is currently not capsicum compatible. Disable sandboxing for such backends. MFC after: 3 days Discussed with: emaste@ Approved by: re (kib) Sponsored by: Mellanox Technologies --- contrib/tcpdump/tcpdump.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/contrib/tcpdump/tcpdump.c b/contrib/tcpdump/tcpdump.c index d08c33ee6eb..31adfed016a 100644 --- a/contrib/tcpdump/tcpdump.c +++ b/contrib/tcpdump/tcpdump.c @@ -2069,6 +2069,9 @@ main(int argc, char **argv) #else cansandbox = (cansandbox && ndo->ndo_nflag); #endif /* HAVE_CASPER */ + cansandbox = (cansandbox && (pcap_fileno(pd) != -1 || + RFileName != NULL)); + if (cansandbox && cap_enter() < 0 && errno != ENOSYS) error("unable to enter the capability mode"); #endif /* HAVE_CAPSICUM */