i did that and for some for reason i didn't get it! it tries to open
timezone so it kinda looks like a red flag right there...
apart from /dev do we need to look into TZ on this one as well? if TZ
var needs to be looked at then all bets are off :/
On 01:01 Sat 08 Jun , Consus wrote:
> On 18:14 Fri 07 Jun, Ricardo Mestre wrote:
> > Hi,
> >
> > My eyes may be cheating me in plain sight, but sysctl(8) doesn't seem to
> > require fs access at all.
> >
> > Comments? OK?
> >
> > Index: sysctl.c
> > ===================================================================
> > RCS file: /cvs/src/sbin/sysctl/sysctl.c,v
> > retrieving revision 1.242
> > diff -u -p -u -r1.242 sysctl.c
> > --- sysctl.c 13 May 2019 20:47:19 -0000 1.242
> > +++ sysctl.c 7 Jun 2019 17:01:23 -0000
> > @@ -255,6 +255,11 @@ main(int argc, char *argv[])
> > argc -= optind;
> > argv += optind;
> >
> > + if (unveil("/", "") == -1)
> > + err(1, "unveil");
> > + if (unveil(NULL, NULL) == -1)
> > + err(1, "unveil");
> > +
> > if (argc == 0 || (Aflag || aflag)) {
> > debuginit();
> > vfsinit();
> >
>
> $ ktrace sysctl >/dev/null; kdump 2>&1 | grep -c 'CALL open'
> 3
>
