From 41f2eb8eabe1fd5a7f7ba85eefac4a9c8be6bef9 Mon Sep 17 00:00:00 2001 From: pkelsey Date: Thu, 4 Jun 2015 04:54:54 +0000 Subject: [PATCH] MFC r283641: Add CAP_FCNTL to the lease file capsicum rights, and limit to CAP_FCNTL_GETFL. Without CAP_FCNTL_GETFL, the lease file truncation in rewrite_client_leases() will fail to trim old data when rewriting the file with a lesser amount of data. git-svn-id: svn://svn.freebsd.org/base/stable/10@283978 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f --- sbin/dhclient/dhclient.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/sbin/dhclient/dhclient.c b/sbin/dhclient/dhclient.c index e05912823..97f9d47d2 100644 --- a/sbin/dhclient/dhclient.c +++ b/sbin/dhclient/dhclient.c @@ -1847,12 +1847,16 @@ rewrite_client_leases(void) leaseFile = fopen(path_dhclient_db, "w"); if (!leaseFile) error("can't create %s: %m", path_dhclient_db); - cap_rights_init(&rights, CAP_FSTAT, CAP_FSYNC, CAP_FTRUNCATE, - CAP_SEEK, CAP_WRITE); + cap_rights_init(&rights, CAP_FCNTL, CAP_FSTAT, CAP_FSYNC, + CAP_FTRUNCATE, CAP_SEEK, CAP_WRITE); if (cap_rights_limit(fileno(leaseFile), &rights) < 0 && errno != ENOSYS) { error("can't limit lease descriptor: %m"); } + if (cap_fcntls_limit(fileno(leaseFile), CAP_FCNTL_GETFL) < 0 && + errno != ENOSYS) { + error("can't limit lease descriptor fcntls: %m"); + } } else { fflush(leaseFile); rewind(leaseFile); -- 2.45.0