summary refs log tree commit diff
diff options
context:
space:
mode:
authorJune McEnroe <june@causal.agency>2020-08-27 18:36:19 -0400
committerJune McEnroe <june@causal.agency>2020-08-27 18:47:01 -0400
commit9975a9357ef8d6ca0a92dda7682d2ec85b6548cc (patch)
tree3a49925007509c57e3a71a23e65130a73ff1f1f0
parentAdd support for OpenBSD (diff)
downloadpounce-9975a9357ef8d6ca0a92dda7682d2ec85b6548cc.tar.gz
pounce-9975a9357ef8d6ca0a92dda7682d2ec85b6548cc.zip
Sandbox calico with pledge(2) and unveil(2)
-rw-r--r--dispatch.c12
1 files changed, 11 insertions, 1 deletions
diff --git a/dispatch.c b/dispatch.c
index f52aacd..c0964e4 100644
--- a/dispatch.c
+++ b/dispatch.c
@@ -155,6 +155,8 @@ static void alert(int sock) {
 }
 
 int main(int argc, char *argv[]) {
+	int error;
+
 	const char *host = "localhost";
 	const char *port = "6697";
 	const char *path = NULL;
@@ -178,10 +180,18 @@ int main(int argc, char *argv[]) {
 		errx(EX_USAGE, "directory required");
 	}
 
+#ifdef __OpenBSD__
+	error = unveil(path, "r");
+	if (error) err(EX_OSERR, "unveil");
+
+	error = pledge("stdio rpath inet unix dns sendfd", NULL);
+	if (error) err(EX_OSERR, "pledge");
+#endif
+
 	int dir = open(path, O_DIRECTORY);
 	if (dir < 0) err(EX_NOINPUT, "%s", path);
 
-	int error = fchdir(dir);
+	error = fchdir(dir);
 	if (error) err(EX_NOINPUT, "%s", path);
 
 	struct addrinfo *head;