$OpenBSD: patch-src_hitch_c,v 1.3 2018/06/02 09:51:33 kn Exp $

Prevent crash after reload with ocsp-dir change:
https://github.com/varnish/hitch/pull/265

Pledge oscp and worker processes.
Pledge the main process iff chroot(2) not used.

Index: src/hitch.c
--- src/hitch.c.orig
+++ src/hitch.c
@@ -2984,6 +2984,9 @@ start_workers(int start_index, int count)
 				    "Refusing to run workers as root.\n");
 				_exit(1);
 			}
+			if (pledge("stdio rpath inet dns", NULL) == -1)
+				fail("pledge");
+			LOGL("{core} pledge called (worker)\n");
 			handle_connections(pfd[0]);
 			exit(0);
 		} else { /* parent. Track new child. */
@@ -3009,6 +3012,9 @@ start_ocsp_proc(void)
 			    "Refusing to run workers as root.\n");
 			_exit(1);
 		}
+		if (pledge("stdio rpath wpath cpath inet dns", NULL) == -1)
+			fail("pledge");
+		LOGL("{core} pledge called (ocsp)\n");
 		handle_ocsp_task();
 	}
 
@@ -3680,7 +3686,8 @@ reconfigure(int argc, char **argv)
 	notify_workers(&wu);
 
 	if (CONFIG->OCSP_DIR != NULL) {
-		(void) kill(ocsp_proc_pid, SIGTERM);
+		if (ocsp_proc_pid != 0)
+			(void) kill(ocsp_proc_pid, SIGTERM);
 		/*
 		 * Restarting the OCSP process is taken
 		 * care of in do_wait
@@ -3824,6 +3831,20 @@ main(int argc, char **argv)
 
 		AZ(VPF_Write(pfh));
 		atexit(remove_pfh);
+	}
+
+	if (!(CONFIG->CHROOT && CONFIG->CHROOT[0])) {
+		if (CONFIG->UID >= 0 || CONFIG->GID >= 0) {
+			if (pledge("stdio rpath wpath cpath inet dns getpw proc id",
+			   NULL) == -1)
+				fail("pledge");
+			LOGL("{core} pledge called (main, uid/gid)\n");
+		} else {
+			if (pledge("stdio rpath wpath cpath inet dns proc",
+			    NULL) == -1)
+				fail("pledge");
+			LOGL("{core} pledge called (main)\n");
+		}
 	}
 
 	start_workers(0, CONFIG->NCORES);
