dzwdz
/
catboy
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Call pledge(2) after unveil(2) 

Simplify logic, be more idiomatic and finalize by pledging after
all unveiling is done by omitting the "unveil" promise and thereby
not allowing further calls to it.
master
Klemens Nanni 2021-01-22 22:01:59 +01:00 committed by C. McEnroe
parent 95bb627ffb
commit a19f48d840
1 changed files with 4 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
chat.c
View File

@ -142,13 +142,7 @@ static void unveilData(const char *name) {
}
}
static void sandbox(const char *trust, const char *cert, const char *priv) {
int error = pledge(
"stdio rpath wpath cpath inet dns tty proc exec unveil", NULL
);
if (error) err(EX_OSERR, "pledge");
if (!self.restricted) return;
static void unveilAll(const char *trust, const char *cert, const char *priv) {
dataMkdir("");
unveilData("");
if (trust) unveilConfig(trust);
@ -161,7 +155,6 @@ static void sandbox(const char *trust, const char *cert, const char *priv) {
} paths[] = {
{ "/usr/share/terminfo", "r" },
{ tls_default_ca_cert_file(), "r" },
{ NULL, NULL },
};
for (size_t i = 0; i < ARRAY_LEN(paths); ++i) {
int error = unveil(paths[i].path, paths[i].perm);
@ -285,7 +278,9 @@ int main(int argc, char *argv[]) {
commandCompleteAdd();
#ifdef __OpenBSD__
sandbox(trust, cert, priv);
if (self.restricted) unveilAll(trust, cert, priv);
int error = pledge("stdio rpath wpath cpath inet dns tty proc exec", NULL);
if (error) err(EX_OSERR, "pledge");
#endif
ircConfig(insecure, trust, cert, priv);