Contributed by rueda on from the not-to-be-confused-with-dlg@ dept.
David Leadbeater (dgl@)
posted to ports@ a message,
entitled
Pledge changes in 7.9-beta,
which explains the consequences for porters
of the recent pledge(2)/unveil(2) changes in -current (and, to some extent, 7.8).
Whilst targeted at porters, it provides a good overview for
anyone interested in the changes.
The message reads:
Previously under certain promises it was possible to open certain files or devices even if the program didn't pledge "rpath" or "wpath". This behavior has gone away in 7.9-beta; libc uses the special __pledge_open(2) syscall which cannot be used outside of libc. We're looking through ports for pledge using ports which might be affected by this, however if you maintain a port which uses pledge you can help by testing it on snapshots (and ideally checking for codepaths which might involve the files below). Feel free to privately send me "x is ok" or such so as as not to flood ports@. (You can also help if the port uses pledge but doesn't have the "# uses pledge()" Makefile comment, I have found some via grepping strings output for "^stdio", but that won't find them if the code uses a non-standard pledge order, among other things.) If a port is opening these files or devices directly (i.e. not as a result of using the libc interfaces that may open these files) then it may need updating. Two common examples seen so far are: - Opening /dev/null for various reasons - Implementing DNS resolution outside of libc and opening files such as /etc/resolv.conf (but there are others, in particular Go implements most of libc itself so is particularly affected by this, I'm looking at some ideas to make that nicer.) A port will need updating if: - It directly opens any of these files after calling pledge() - It does not pledge "rpath" and/or "wpath" (wpath relevant for /dev/null and /dev/tty only) OR - It uses unveil() of specific files The update will look like: - Adding the relevant pledges "rpath" or "wpath" if it does not already have them; - Add an unveil for the path with the permissions matching the mode(s) the file or device is opened with. - Alternatively adjust the code to open() before pledge() (and remember you can reduce pledges, so it may be possible to pledge with "rpath wpath" and later drop one or both of those). The list of promises and the special paths which could previously be opened under that promise is: stdio /dev/null (rpath or wpath) /etc/localtime /usr/share/zoneinfo tty /dev/tty (rpath or wpath) dns /etc/resolv.conf /etc/hosts /etc/services /etc/protocols getpw /etc/group /etc/netid /etc/pwd.db (the .db files really should be left to the system) /etc/spwd.db (could not open, but returned EPERM)
Whilst a new committer, David has been involved heavily
in the recent pledge(2)/unveil(2) changes.