X-Git-Url: https://www.tinc-vpn.org/git/browse?a=blobdiff_plain;f=src%2Ftincctl.c;h=a0a0281023eed94d00095fa5244c5d41ce3dc275;hb=4436af55e55e79b496264fe114039fbc1198d71f;hp=a18f6ce6552726e7b13e49e1c683a0ef8e5d54a6;hpb=e62fd508158749a0d55eae06c2e361df5d6da6e0;p=tinc

diff --git a/src/tincctl.c b/src/tincctl.c
index a18f6ce6..a0a02810 100644
--- a/src/tincctl.c
+++ b/src/tincctl.c
@@ -41,6 +41,7 @@
 #include "subnet.h"
 #include "keys.h"
 #include "random.h"
+#include "sandbox.h"
 #include "pidfile.h"
 #include "console.h"
 
@@ -108,7 +109,7 @@ static struct option const long_options[] = {
 };
 
 static void version(void) {
-	static const char *message =
+	fprintf(stdout,
 	        "%s version %s (built %s %s, protocol %d.%d)\n"
 	        "Features:"
 #ifdef HAVE_READLINE
@@ -119,6 +120,9 @@ static void version(void) {
 #endif
 #ifndef DISABLE_LEGACY
 	        " legacy_protocol"
+#endif
+#ifdef HAVE_SANDBOX
+	        " sandbox"
 #endif
 	        "\n\n"
 	        "Copyright (C) 1998-2018 Ivo Timmermans, Guus Sliepen and others.\n"
@@ -126,16 +130,15 @@ static void version(void) {
 	        "\n"
 	        "tinc comes with ABSOLUTELY NO WARRANTY.  This is free software,\n"
 	        "and you are welcome to redistribute it under certain conditions;\n"
-	        "see the file COPYING for details.\n";
-
-	printf(message, PACKAGE, BUILD_VERSION, BUILD_DATE, BUILD_TIME, PROT_MAJOR, PROT_MINOR);
+	        "see the file COPYING for details.\n",
+	        PACKAGE, BUILD_VERSION, BUILD_DATE, BUILD_TIME, PROT_MAJOR, PROT_MINOR);
 }
 
 static void usage(bool status) {
 	if(status) {
 		fprintf(stderr, "Try `%s --help\' for more information.\n", program_name);
 	} else {
-		static const char *message =
+		fprintf(stdout,
 		        "Usage: %s [options] command\n"
 		        "\n"
 		        "Valid options are:\n"
@@ -194,9 +197,8 @@ static void usage(bool status) {
 		        "  sign [FILE]                Generate a signed version of a file.\n"
 		        "  verify NODE [FILE]         Verify that a file was signed by the given NODE.\n"
 		        "\n"
-		        "Report bugs to tinc@tinc-vpn.org.\n";
-
-		printf(message, program_name);
+		        "Report bugs to tinc@tinc-vpn.org.\n",
+		        program_name);
 	}
 }
 
@@ -1623,7 +1625,8 @@ char *get_my_name(bool verbose) {
 	return NULL;
 }
 
-ecdsa_t *get_pubkey(FILE *f) {
+static ecdsa_t *get_pubkey(FILE *f) ATTR_MALLOC ATTR_DEALLOCATOR(ecdsa_free);
+static ecdsa_t *get_pubkey(FILE *f) {
 	char buf[4096];
 	char *value;
 
@@ -1696,6 +1699,7 @@ const var_t variables[] = {
 	{"ProcessPriority", VAR_SERVER},
 	{"Proxy", VAR_SERVER},
 	{"ReplayWindow", VAR_SERVER | VAR_SAFE},
+	{"Sandbox", VAR_SERVER},
 	{"ScriptsExtension", VAR_SERVER},
 	{"ScriptsInterpreter", VAR_SERVER},
 	{"StrictSubnets", VAR_SERVER | VAR_SAFE},
@@ -3351,6 +3355,9 @@ int main(int argc, char *argv[]) {
 	crypto_init();
 	prng_init();
 
+	sandbox_set_level(SANDBOX_NORMAL);
+	sandbox_enter();
+
 	int result = run_command(argc, argv);
 
 	random_exit();