The first one would need some tinkering by inspecting the log prior to applying the pledge, but somehow doable. The second? Not that easy...
I'll revert to the previous version later on today, it needs a proper analysis done before enabling pledge again. On 21:10 Tue 04 Jul , Tim van der Molen wrote: > Ricardo Mestre (2017-07-04 18:22 +0200): > > What about applying the pledge early on only if snaplen is not being > > defined, > > but if it is then call pledge as well but only after the filter is applied > > (this is where the offending ioctl is called)? > > I think there are two problems with this approach: > > - It doesn't cover the case where -s has not been used, but the logfile > does have a nonstandard snaplen. > > - If the logfile has a different snaplen, then the snaplen will have to > be changed for a second time later on, when the logfile has been > rotated. But at that point pledge has already been called. >
