sandbox pre-auth privsep child

[Daniel Kahn Gillmor]

On 06/22/2011 09:06 AM, Damien Miller wrote:
>> This patch (relative to -HEAD) defines an API to allow sandboxing of the
>> pre-auth privsep child and a couple of sandbox implementations.

thanks for doing this, Damien.  I like this approach.  A quick note on
this test:


> -		if (box != NULL)
> +		if (box != NULL) {
>  			ssh_sandbox_child(box);
> +			if (fork() != -1)
> +				fatal("fork() succeeded despite sandbox");
> +			if (socket(AF_INET, SOCK_STREAM, 0) != -1)
> +				fatal("fork() succeeded despite sandbox");

i think this error message should mention socket() instead of fork().

Regards,

	--dkg

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 1030 bytes
Desc: OpenPGP digital signature
URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20110622/4e61d056/attachment-0001.bin>