From 837c9efce434acf75834fd9ef8a5a05c1fa61004 Mon Sep 17 00:00:00 2001 From: Klemens Nanni Date: Fri, 22 Jan 2021 22:02:01 +0100 Subject: Drop exec capability iff restricted Nothing must be executed when running /copy, et al. --- chat.c | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'chat.c') diff --git a/chat.c b/chat.c index bc035e3..b36223c 100644 --- a/chat.c +++ b/chat.c @@ -340,6 +340,13 @@ int main(int argc, char *argv[]) { fcntl(execPipe[1], F_SETFD, FD_CLOEXEC); } +#ifdef __OpenBSD__ + if (self.restricted) { + error = pledge("stdio rpath wpath cpath tty", NULL); + if (error) err(EX_OSERR, "pledge"); + } +#endif + struct pollfd fds[] = { { .events = POLLIN, .fd = STDIN_FILENO }, { .events = POLLIN, .fd = irc }, -- cgit 1.4.1