bugfix: chdir(/) after chroot

[oweals/tinc.git] / src / tincd.c

diff --git a/src/tincd.c b/src/tincd.c
index a8a0146dfc32a87813ab3d00f04a65c8e9b61ff5..89bda91b0119424ce1d7496a72ffb0fc92e8588f 100644 (file)
--- a/src/tincd.c
+++ b/src/tincd.c
@@ -160,8 +160,13 @@ static bool parse_options(int argc, char **argv)
                                break;
 
                        case 'L':                               /* no detach */
+#ifndef HAVE_MLOCKALL
+                               logger(LOG_ERR, _("mlockall() not supported on this platform!"));
+                               return false;
+#else
                                do_mlock = true;
                                break;
+#endif
 
                        case 'd':                               /* inc debug level */
                                if(optarg)
@@ -460,7 +465,7 @@ static bool drop_privs() {
        }
        if (do_chroot) {
                tzset();        /* for proper timestamps in logs */
-               if (chroot(confbase) != 0 || chdir(".") != 0) {
+               if (chroot(confbase) != 0 || chdir("/") != 0) {
                        logger(LOG_ERR, _("%s failed"), "chroot()");
                        return false;
                }
@@ -511,20 +516,6 @@ int main(int argc, char **argv)
 
        openlogger("tinc", use_logfile?LOGMODE_FILE:LOGMODE_STDERR);
 
-       /* Lock all pages into memory if requested */
-
-       if(do_mlock)
-#ifdef HAVE_MLOCKALL
-               if(mlockall(MCL_CURRENT | MCL_FUTURE)) {
-                       logger(LOG_ERR, _("System call `%s' failed: %s"), "mlockall",
-                                  strerror(errno));
-#else
-       {
-               logger(LOG_ERR, _("mlockall() not supported on this platform!"));
-#endif
-               return -1;
-       }
-
        g_argv = argv;
 
        init_configuration(&config_tree);
@@ -570,6 +561,17 @@ int main2(int argc, char **argv)
        if(!detach())
                return 1;
 
+#ifdef HAVE_MLOCKALL
+       /* Lock all pages into memory if requested.
+        * This has to be done after daemon()/fork() so it works for child.
+        * No need to do that in parent as it's very short-lived. */
+       if(do_mlock && mlockall(MCL_CURRENT | MCL_FUTURE) != 0) {
+               logger(LOG_ERR, _("System call `%s' failed: %s"), "mlockall",
+                  strerror(errno));
+               return 1;
+       }
+#endif
+
        /* Setup sockets and open device. */
 
        if(!setup_network())