move all sandbox-related code to sandbox.c

while there, add capsicum for the logger process

1 files changed, 2 insertions, 14 deletions

diff --git a/ex.c b/ex.c
index 6817024..645e865 100644
--- a/ex.c
+++ b/ex.c
@@ -270,23 +270,9 @@ handle_dispatch_imsg(int fd, short ev, void *d)
 int
 executor_main(struct imsgbuf *ibuf)
 {
-	struct vhost	*vhost;
 	struct event	 evs[PROC_MAX], imsgev;
 	int		 i;
 
-#ifdef __OpenBSD__
-	for (vhost = hosts; vhost->domain != NULL; ++vhost) {
-		/* r so we can chdir into the correct directory */
-		if (unveil(vhost->dir, "rx") == -1)
-			err(1, "unveil %s for domain %s",
-			    vhost->dir, vhost->domain);
-	}
-
-	/* rpath to chdir into the correct directory */
-	if (pledge("stdio rpath sendfd proc exec", NULL))
-		err(1, "pledge");
-#endif
-
 	event_init();
 
 	if (ibuf != NULL) {
@@ -301,6 +287,8 @@ executor_main(struct imsgbuf *ibuf)
 		event_add(&evs[i], NULL);
 	}
 
+	sandbox_executor_process();
+
 	event_dispatch();
 
 	return 1;