When biff(1) is set to y, comsat opens the tty for write.

        if ((tp = fopen(tty, "w")) == NULL) {
                dsyslog(LOG_ERR, "%s: %s", tty, strerror(errno));
                _exit(1);
        }

This aborts:

(gdb) bt
#0  0x0890a441 in open () at <stdin>:2
#1  0x0897e308 in *_libc_fopen (file=0xcf7fba93 "/dev/ttyp0", mode=0x3a8d2068 
"w") at /usr/src/lib/libc/stdio/fopen.c:54
#2  0x1a8d362b in notify (utp=0x89966a20, offset=556) at 
/usr/src/libexec/comsat/comsat.c:260
#3  0x1a8d39cb in mailfor (name=0xcf7fc080 "josh") at 
/usr/src/libexec/comsat/comsat.c:228
#4  0x1a8d3e87 in main () at /usr/src/libexec/comsat/comsat.c:143
Current language:  auto; currently asm
(gdb) q

This patch adds cpath.  Developed and tested on 5.9-stable, which is where
the problem was seen.  1.44 is also HEAD, so this should apply to -current.

Index: comsat.c
===================================================================
RCS file: /systems/cvs/src/libexec/comsat/comsat.c,v
retrieving revision 1.44
diff -u -p -r1.44 comsat.c
--- comsat.c    12 Oct 2015 16:54:30 -0000      1.44
+++ comsat.c    1 Apr 2016 21:06:49 -0000
@@ -91,7 +91,7 @@ main(int argc, char *argv[])
                exit(1);
        }
 
-       if (pledge("stdio rpath wpath proc tty", NULL) == -1)
+       if (pledge("stdio rpath wpath cpath proc tty", NULL) == -1)
                err(1, "pledge");
 
        openlog("comsat", LOG_PID, LOG_DAEMON);

Reply via email to