bx
/
catgirl
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

OpenBSD: pledge minimum promises from the start 

catgirl needs:
- "stdio tty" at all times
- "rpath inet dns" once at startup for terminfo(5) and ssl(8)
- "proc exec" iff -R/restrict options is disabled
- "rpath wpath cpath" iff -s/save or -l/log options is enabled

Status quo:  catgirl starts with the superset of all possible promises
"stdio rpath wpath cpath inet dns tty proc exec", drops offline with
"stdio rpath wpath cpath tty proc exec" and possibly drops to either of
"stdio rpath wpath cpath tty", "stdio tty proc exec" or "stdio tty"
depending on the options used.

Such step-by-step reduction is straight forward and easy to model along
the process runtime, but it comes with the drawback of starting with
too broad promises right from the beginning, i.e. `catgirl -R -h host'
is able to execute code and write to filesystems even though it must
never do so according the (un)used options.

Lay out required promises up front and pledge in two stages:
1. initial setup, i.e. fixed "stdio tty" plus temporary "rpath inet dns"
   plus potential "rpath wpath cpath" plus potential "proc exec"
2. final rutime,  i.e. fixed "stdio tty"
   plus potential "rpath wpath cpath" plus potential "proc exec"

This way the above mentioned usage example can never execute or write
files, hence less potential for bugs and more accurate modelling of
catgirl's runtime -- dropping "inet dns" alone in between also becomes
obsolete with this approach.
weechat-hashes
Klemens Nanni 2021-06-06 23:00:43 +00:00 committed by C. McEnroe
parent c97a9eb870
commit 3d931d0f5a
1 changed files with 13 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
chat.c
View File

@ -311,7 +311,17 @@ int main(int argc, char *argv[]) {
#ifdef __OpenBSD__
if (self.restricted) unveilAll(trust, cert, priv);
int error = pledge("stdio rpath wpath cpath inet dns tty proc exec", NULL);
char promises[64] = "stdio tty";
struct Cat cat = { promises, sizeof(promises), strlen(promises) };
if (save || logEnable) catf(&cat, " rpath wpath cpath");
if (!self.restricted) catf(&cat, " proc exec");
char *promisesFinal = strdup(promises);
if (!promisesFinal) err(EX_OSERR, "strdup");
catf(&cat, " rpath inet dns");
int error = pledge(promises, NULL);
if (error) err(EX_OSERR, "pledge");
#endif
@ -330,10 +340,6 @@ int main(int argc, char *argv[]) {
uiDraw();
int irc = ircConnect(bind, host, port);
#ifdef __OpenBSD__
error = pledge("stdio rpath wpath cpath tty proc exec", NULL);
if (error) err(EX_OSERR, "pledge");
#endif
if (pass) ircFormat("PASS :%s\r\n", pass);
if (sasl) ircFormat("CAP REQ :sasl\r\n");
@ -364,12 +370,9 @@ int main(int argc, char *argv[]) {
}
#ifdef __OpenBSD__
char promises[64] = "stdio tty";
struct Cat cat = { promises, sizeof(promises), strlen(promises) };
if (save || logEnable) catf(&cat, " rpath wpath cpath");
if (!self.restricted) catf(&cat, " proc exec");
error = pledge(promises, NULL);
error = pledge(promisesFinal, NULL);
if (error) err(EX_OSERR, "pledge");
free(promisesFinal);
#endif
struct pollfd fds[] = {