Add a temporary patch to remove tmppath from pledge in favour of

unveil(_PATH_TMP)+pledge("rpath wpath cpath").

This patch is to bridge the time until a new release of dkimsign can be
made.

OK op@ kirill@
This commit is contained in:
martijn
2026-02-25 09:16:33 +00:00
parent 0f1dc31f6b
commit 4aab9ae4d8
2 changed files with 23 additions and 0 deletions
+1
View File
@@ -1,6 +1,7 @@
COMMENT= dkim signer integration to the OpenSMTPD daemon
V= 0.6
REVISION= 0
FILTER_NAME = dkimsign
DISTNAME = filter-dkimsign-${V}
@@ -0,0 +1,22 @@
Index: main.c
--- main.c.orig
+++ main.c
@@ -22,6 +22,7 @@
#include <errno.h>
#include <fcntl.h>
#include <limits.h>
+#include <paths.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
@@ -220,7 +221,9 @@ main(int argc, char *argv[])
OpenSSL_add_all_digests();
- if (pledge("tmppath stdio", NULL) == -1)
+ if (unveil(_PATH_TMP, "rwc") == -1)
+ osmtpd_err(1, "unveil");
+ if (pledge("stdio rpath wpath cpath", NULL) == -1)
osmtpd_err(1, "pledge");
if ((hash_md = EVP_get_digestbyname(hashalg)) == NULL)