When biff(1) is set to y, comsat opens the tty for write. if ((tp = fopen(tty, "w")) == NULL) { dsyslog(LOG_ERR, "%s: %s", tty, strerror(errno)); _exit(1); }
This aborts: (gdb) bt #0 0x0890a441 in open () at <stdin>:2 #1 0x0897e308 in *_libc_fopen (file=0xcf7fba93 "/dev/ttyp0", mode=0x3a8d2068 "w") at /usr/src/lib/libc/stdio/fopen.c:54 #2 0x1a8d362b in notify (utp=0x89966a20, offset=556) at /usr/src/libexec/comsat/comsat.c:260 #3 0x1a8d39cb in mailfor (name=0xcf7fc080 "josh") at /usr/src/libexec/comsat/comsat.c:228 #4 0x1a8d3e87 in main () at /usr/src/libexec/comsat/comsat.c:143 Current language: auto; currently asm (gdb) q This patch adds cpath. Developed and tested on 5.9-stable, which is where the problem was seen. 1.44 is also HEAD, so this should apply to -current. Index: comsat.c =================================================================== RCS file: /systems/cvs/src/libexec/comsat/comsat.c,v retrieving revision 1.44 diff -u -p -r1.44 comsat.c --- comsat.c 12 Oct 2015 16:54:30 -0000 1.44 +++ comsat.c 1 Apr 2016 21:06:49 -0000 @@ -91,7 +91,7 @@ main(int argc, char *argv[]) exit(1); } - if (pledge("stdio rpath wpath proc tty", NULL) == -1) + if (pledge("stdio rpath wpath cpath proc tty", NULL) == -1) err(1, "pledge"); openlog("comsat", LOG_PID, LOG_DAEMON);