svn commit: r283641 - head/sbin/dhclient

[Patrick Kelsey]

Author: pkelsey
Date: Thu May 28 05:38:07 2015
New Revision: 283641
URL: https://svnweb.freebsd.org/changeset/base/283641

Log:
  Add CAP_FCNTL to the lease file capsicum rights, and limit to
  CAP_FCNTL_GETFL.  Without CAP_FCNTL_GETFL, the lease file truncation
  in rewrite_client_leases() will fail to trim old data when rewriting
  the file with a lesser amount of data.
  
  Reviewed by: pjd, rwatson
  Approved by: jmallett (mentor)
  MFC after: 1 week

Modified:
  head/sbin/dhclient/dhclient.c

Modified: head/sbin/dhclient/dhclient.c
==============================================================================
--- head/sbin/dhclient/dhclient.c	Thu May 28 00:11:36 2015	(r283640)
+++ head/sbin/dhclient/dhclient.c	Thu May 28 05:38:07 2015	(r283641)
@@ -1845,12 +1845,16 @@ rewrite_client_leases(void)
 		leaseFile = fopen(path_dhclient_db, "w");
 		if (!leaseFile)
 			error("can't create %s: %m", path_dhclient_db);
-		cap_rights_init(&rights, CAP_FSTAT, CAP_FSYNC, CAP_FTRUNCATE,
-		    CAP_SEEK, CAP_WRITE);
+		cap_rights_init(&rights, CAP_FCNTL, CAP_FSTAT, CAP_FSYNC,
+		    CAP_FTRUNCATE, CAP_SEEK, CAP_WRITE);
 		if (cap_rights_limit(fileno(leaseFile), &rights) < 0 &&
 		    errno != ENOSYS) {
 			error("can't limit lease descriptor: %m");
 		}
+		if (cap_fcntls_limit(fileno(leaseFile), CAP_FCNTL_GETFL) < 0 &&
+		    errno != ENOSYS) {
+			error("can't limit lease descriptor fcntls: %m");
+		}
 	} else {
 		fflush(leaseFile);
 		rewind(leaseFile);