diff options
| author | pjd <pjd@FreeBSD.org> | 2011-03-21 21:31:50 +0000 |
|---|---|---|
| committer | pjd <pjd@FreeBSD.org> | 2011-03-21 21:31:50 +0000 |
| commit | b84a0251e39001ae198d49f18d470ceb827c5dc8 (patch) | |
| tree | 423b8a1794223b5607ff01f014ec10c088e66a0b /sbin/hastd/primary.c | |
| parent | 3591d152b2cc88ff15075e1eba664d04f99fbcd2 (diff) | |
| download | FreeBSD-src-b84a0251e39001ae198d49f18d470ceb827c5dc8.zip FreeBSD-src-b84a0251e39001ae198d49f18d470ceb827c5dc8.tar.gz | |
When dropping privileges prefer capsicum over chroot+setgid+setuid.
We can use capsicum for secondary worker processes and hastctl.
When working as primary we drop privileges using chroot+setgid+setuid
still as we need to send ioctl(2)s to ggate device, for which capsicum
doesn't allow (yet).
X-MFC after: capsicum is merged to stable/8
Diffstat (limited to 'sbin/hastd/primary.c')
| -rw-r--r-- | sbin/hastd/primary.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sbin/hastd/primary.c b/sbin/hastd/primary.c index 6b219f8..73f8f65 100644 --- a/sbin/hastd/primary.c +++ b/sbin/hastd/primary.c @@ -874,7 +874,7 @@ hastd_primary(struct hast_resource *res) init_ggate(res); init_environment(res); - if (drop_privs() != 0) { + if (drop_privs(true) != 0) { cleanup(res); exit(EX_CONFIG); } |
