From 144c75363738965c70335217b6b6722a4a6c0b16 Mon Sep 17 00:00:00 2001
From: "C. McEnroe" <june@causal.agency>
Date: Thu, 2 Sep 2021 18:22:23 -0400
Subject: OpenBSD: pledge(2) the genCert code path

---
 bounce.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

(limited to 'bounce.c')

diff --git a/bounce.c b/bounce.c
index d8e9b87..c6bd7b1 100644
--- a/bounce.c
+++ b/bounce.c
@@ -624,8 +624,14 @@ static void genCert(const char *path, const char *ca) {
 	int out = open(path, O_WRONLY | O_APPEND | O_CREAT, 0600);
 	if (out < 0) err(EX_CANTCREAT, "%s", path);
 
+	int error;
+#ifdef __OpenBSD__
+	error = pledge("stdio proc exec", NULL);
+	if (error) err(EX_OSERR, "pledge");
+#endif
+
 	int rw[2];
-	int error = pipe(rw);
+	error = pipe(rw);
 	if (error) err(EX_OSERR, "pipe");
 
 	pid_t pid = fork();
-- 
cgit 1.4.1