Showing the symbolic name is not doing anywhere else in the tree.
Most likely they should be
err(1, "unveil: %s", path);
Ashton Fagg <ash...@fagg.id.au> wrote:
> Ashton Fagg <ash...@fagg.id.au> writes:
>
> > Hi all,
> >
> > I saw a discussion on here a while ago about the use of patterns like:
> >
> > if (unveil(some_path, "r") == -1)
> > err(1, "unveil");
> >
> > And why that's maybe not preferable for debugging and troubleshooting
> > purposes for programs which have multiple unveil calls (which happens
> > fairly often).
> >
> > Original message here:
> > https://marc.info/?l=openbsd-tech&m=161470144611031&w=2
>
> I decided just to go ahead and do this since I noticed there's some
> newer stuff not following this pattern (dhcpleased for example). Here are
> patches for:
>
> games/tetris
> bin/ps
> sbin/dhclient
> sbin/fsck
> sbin/fsck_msdos
> sbin/fsck_ffs
> sbin/nologin
> sbin/pflogd
> sbin/ping
> sbin/shutdown
> sbin/sysctl
> sbin/unwind
>
> I'll tackle /usr/bin and /usr/sbin another time.
>
> diff --git a/bin/ps/ps.c b/bin/ps/ps.c
> index 84be7afe802..3b6593a46a1 100644
> --- a/bin/ps/ps.c
> +++ b/bin/ps/ps.c
> @@ -276,18 +276,18 @@ main(int argc, char *argv[])
> errx(1, "%s", errbuf);
>
> if (unveil(_PATH_DEVDB, "r") == -1 && errno != ENOENT)
> - err(1, "unveil");
> + err(1, "unveil: _PATH_DEVDB -> %s", _PATH_DEVDB);
> if (unveil(_PATH_DEV, "r") == -1 && errno != ENOENT)
> - err(1, "unveil");
> + err(1, "unveil: _PATH_DEV -> %s", _PATH_DEV);
> if (swapf)
> if (unveil(swapf, "r") == -1)
> - err(1, "unveil");
> + err(1, "unveil: swapf -> %s", swapf);
> if (nlistf)
> if (unveil(nlistf, "r") == -1)
> - err(1, "unveil");
> + err(1, "unveil: nlistf -> %s", nlistf);
> if (memf)
> if (unveil(memf, "r") == -1)
> - err(1, "unveil");
> + err(1, "unveil: memf -> %s", memf);
> if (pledge("stdio rpath getpw ps", NULL) == -1)
> err(1, "pledge");
>
> diff --git a/games/tetris/tetris.c b/games/tetris/tetris.c
> index 69f4532a4ac..fdb7e7d2d40 100644
> --- a/games/tetris/tetris.c
> +++ b/games/tetris/tetris.c
> @@ -234,7 +234,7 @@ main(int argc, char *argv[])
> scr_init();
>
> if (unveil(scorepath, "rwc") == -1)
> - err(1, "unveil");
> + err(1, "unveil: scorepath -> %s", scorepath);
>
> if (pledge("stdio rpath wpath cpath tty", NULL) == -1)
> err(1, "pledge");
> diff --git a/sbin/dhclient/dhclient.c b/sbin/dhclient/dhclient.c
> index 993c829f2d2..ba88d9f5f67 100644
> --- a/sbin/dhclient/dhclient.c
> +++ b/sbin/dhclient/dhclient.c
> @@ -2334,11 +2334,11 @@ fork_privchld(struct interface_info *ifi, int fd, int
> fd2)
> fatal("socket(AF_ROUTE, SOCK_RAW)");
>
> if (unveil(_PATH_RESCONF, "wc") == -1)
> - fatal("unveil");
> + fatal("unveil: _PATH_RESCONF -> %s", _PATH_RESCONF);
> if (unveil("/etc/resolv.conf.tail", "r") == -1)
> - fatal("unveil");
> + fatal("unveil: /etc/resolve.conf.tail");
> if (unveil(NULL, NULL) == -1)
> - fatal("unveil");
> + fatal("unveil(NULL,NULL)");
>
> while (quit == 0) {
> pfd[0].fd = priv_ibuf->fd;
> diff --git a/sbin/fsck/fsck.c b/sbin/fsck/fsck.c
> index 09475f346d3..ce3826885c4 100644
> --- a/sbin/fsck/fsck.c
> +++ b/sbin/fsck/fsck.c
> @@ -110,11 +110,11 @@ main(int argc, char *argv[])
> checkroot();
>
> if (unveil("/dev", "rw") == -1)
> - err(1, "unveil");
> + err(1, "unveil: /dev");
> if (unveil(_PATH_FSTAB, "r") == -1)
> - err(1, "unveil");
> + err(1, "unveil: _PATH_FSTAB -> %s", _PATH_FSTAB);
> if (unveil("/sbin", "x") == -1)
> - err(1, "unveil");
> + err(1, "unveil /sbin");
> if (pledge("stdio rpath wpath disklabel proc exec", NULL) == -1)
> err(1, "pledge");
>
> diff --git a/sbin/fsck_msdos/check.c b/sbin/fsck_msdos/check.c
> index 4a2f07f1131..b011cd7dca6 100644
> --- a/sbin/fsck_msdos/check.c
> +++ b/sbin/fsck_msdos/check.c
> @@ -55,7 +55,7 @@ checkfilesys(const char *fname)
> int mod = 0;
>
> if (unveil("/dev", "rw") == -1)
> - err(1, "unveil");
> + err(1, "unveil /dev");
>
> rdonly = alwaysno;
>
> diff --git a/sbin/fsck_ffs/setup.c b/sbin/fsck_ffs/setup.c
> index e9c922d7c37..e3706d7b759 100644
> --- a/sbin/fsck_ffs/setup.c
> +++ b/sbin/fsck_ffs/setup.c
> @@ -105,7 +105,7 @@ setup(char *dev, int isfsdb)
>
> if (isfsdb || !hotroot()) {
> if (unveil("/dev", "rw") == -1)
> - err(1, "unveil");
> + err(1, "unveil /dev");
> if (pledge("stdio rpath wpath getpw tty disklabel",
> NULL) == -1)
> err(1, "pledge");
> diff --git a/sbin/nologin/nologin.c b/sbin/nologin/nologin.c
> index 88bdd5f6fd7..7eb39266c56 100644
> --- a/sbin/nologin/nologin.c
> +++ b/sbin/nologin/nologin.c
> @@ -47,7 +47,7 @@ main(int argc, char *argv[])
> char nbuf[BUFSIZ];
>
> if (unveil(_PATH_NOLOGIN_TXT, "r") == -1)
> - err(1, "unveil");
> + err(1, "unveil: _PATH_NOLOGIN_TXT -> %s", _PATH_NOLOGIN_TXT);
> if (pledge("stdio rpath", NULL) == -1)
> err(1, "pledge");
>
> diff --git a/sbin/pflogd/privsep.c b/sbin/pflogd/privsep.c
> index a1c109005cf..fa0ec37ae6a 100644
> --- a/sbin/pflogd/privsep.c
> +++ b/sbin/pflogd/privsep.c
> @@ -134,17 +134,17 @@ priv_init(int Pflag, int argc, char *argv[])
> setproctitle("[priv]");
>
> if (unveil(_PATH_RESCONF, "r") == -1)
> - err(1, "unveil");
> + err(1, "unveil: _PATH_RECONF -> %s", _PATH_RESCONF);
> if (unveil(_PATH_HOSTS, "r") == -1)
> - err(1, "unveil");
> + err(1, "unveil: _PATH_HOSTS -> %s", _PATH_HOSTS);
> if (unveil(_PATH_SERVICES, "r") == -1)
> - err(1, "unveil");
> + err(1, "unveil: _PATH_SERVICES -> %s", _PATH_SERVICES);
> if (unveil("/dev/bpf", "r") == -1)
> - err(1, "unveil");
> + err(1, "unveil /dev/bpf");
> if (unveil(filename, "rwc") == -1)
> - err(1, "unveil");
> + err(1, "unveil: filename -> %s", filename);
> if (unveil(NULL, NULL) == -1)
> - err(1, "unveil");
> + err(1, "unveil(NULL,NULL)");
>
> #if 0
> /* This needs to do bpf ioctl */
> diff --git a/sbin/ping/ping.c b/sbin/ping/ping.c
> index f7c3c101b25..63585019da2 100644
> --- a/sbin/ping/ping.c
> +++ b/sbin/ping/ping.c
> @@ -266,9 +266,9 @@ main(int argc, char *argv[])
>
> /* Cannot pledge due to special setsockopt()s below */
> if (unveil("/", "r") == -1)
> - err(1, "unveil");
> + err(1, "unveil /");
> if (unveil(NULL, NULL) == -1)
> - err(1, "unveil");
> + err(1, "unveil(NULL,NULL)");
>
> if (strcmp("ping6", __progname) == 0) {
> v6flag = 1;
> diff --git a/sbin/shutdown/shutdown.c b/sbin/shutdown/shutdown.c
> index d28eb676172..94c323c25dc 100644
> --- a/sbin/shutdown/shutdown.c
> +++ b/sbin/shutdown/shutdown.c
> @@ -166,24 +166,24 @@ main(int argc, char *argv[])
> }
>
> if (unveil(_PATH_CONSOLE, "rw") == -1)
> - err(1, "unveil");
> + err(1, "unveil: _PATH_CONSOLE -> %s", _PATH_CONSOLE);
> if (unveil(_PATH_RC, "r") == -1)
> - err(1, "unveil");
> + err(1, "unveil: _PATH_RC -> %s", _PATH_RC);
> if (unveil(_PATH_WALL, "x") == -1)
> - err(1, "unveil");
> + err(1, "unveil: _PATH_WALL -> %s", _PATH_WALL);
> if (unveil(_PATH_FASTBOOT, "wc") == -1)
> - err(1, "unveil");
> + err(1, "unveil: _PATH_FASTBOOT -> %s", _PATH_FASTBOOT);
> if (unveil(_PATH_NOLOGIN, "wc") == -1)
> - err(1, "unveil");
> + err(1, "unveil: _PATH_NOLOGIN -> %s", _PATH_NOLOGIN);
> if (dohalt || dopower) {
> if (unveil(_PATH_HALT, "x") == -1)
> - err(1, "unveil");
> + err(1, "unveil: _PATH_HALT -> %s", _PATH_HALT);
> } else if (doreboot) {
> if (unveil(_PATH_REBOOT, "x") == -1)
> - err(1, "unveil");
> + err(1, "unveil: _PATH_REBOOT -> %s", _PATH_REBOOT);
> } else {
> if (unveil(_PATH_BSHELL, "x") == -1)
> - err(1, "unveil");
> + err(1, "unveil: _PATH_BSHELL -> %s", _PATH_BSHELL);
> }
> if (pledge("stdio rpath wpath cpath getpw tty id proc exec", NULL) ==
> -1)
> err(1, "pledge");
> diff --git a/sbin/sysctl/sysctl.c b/sbin/sysctl/sysctl.c
> index 5e9e562d308..b2fc7588b76 100644
> --- a/sbin/sysctl/sysctl.c
> +++ b/sbin/sysctl/sysctl.c
> @@ -264,11 +264,11 @@ main(int argc, char *argv[])
> ctime(&boottime); /* satisfy potential $TZ expansion before unveil() */
>
> if (unveil(_PATH_DEVDB, "r") == -1 && errno != ENOENT)
> - err(1,"unveil");
> + err(1,"unveil: _PATH_DEVDB -> %s", _PATH_DEVDB);
> if (unveil("/dev", "r") == -1 && errno != ENOENT)
> - err(1, "unveil");
> + err(1, "unveil /dev");
> if (unveil(NULL, NULL) == -1)
> - err(1, "unveil");
> + err(1, "unveil(NULL,NULL)");
>
> if (argc == 0 || (Aflag || aflag)) {
> debuginit();
> diff --git a/sbin/unwind/resolver.c b/sbin/unwind/resolver.c
> index 2db2e7274ab..9c4916e2a8c 100644
> --- a/sbin/unwind/resolver.c
> +++ b/sbin/unwind/resolver.c
> @@ -377,7 +377,7 @@ resolver(int debug, int verbose)
> fatal("can't drop privileges");
>
> if (unveil(TLS_DEFAULT_CA_CERT_FILE, "r") == -1)
> - fatal("unveil");
> + fatal("unveil: TLS_DEFAULT_CA_CERT_FILE -> %s",
> TLS_DEFAULT_CA_CERT_FILE);
>
> if (pledge("stdio inet dns rpath recvfd", NULL) == -1)
> fatal("pledge");
