yggdrasil-network/yggdrasil-go
1
0
Fork 0
mirror of https://github.com/yggdrasil-network/yggdrasil-go.git synced 2025-11-04 03:05:07 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

genkeys, yggdrasilctl: Use pledge(2) on OpenBSD (#1193)

Browse source 
Restrict system operations of CLI tools with
https://man.openbsd.org/pledge.2.

https://pkg.go.dev/suah.dev/protect abstracts the OS specific code, i.e.
is a NOOP on non-OpenBSD systems.

This PR is to gauge upstream interest in this direction; my OpenBSD port
of yggdrasil already pledges the daemon,
resulting in minimal runtime privileges, but there are still a few rough
edges:

https://github.com/jasperla/openbsd-wip/blob/master/net/yggdrasil/patches/patch-cmd_yggdrasil_main_go#L80

---------

Co-authored-by: Neil <git@neilalexander.dev>
This commit is contained in:
Klemens Nanni 2024-12-12 21:48:24 +03:00 • committed by GitHub
parent b2b0396d48
commit 2d587740c1
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 18 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
cmd/genkeys/main.go
View file

@ -18,6 +18,8 @@ import (
"runtime" "runtime"
"time" "time"
"suah.dev/protect"
"github.com/yggdrasil-network/yggdrasil-go/src/address" "github.com/yggdrasil-network/yggdrasil-go/src/address"
) )
@ -27,6 +29,10 @@ type keySet struct {
} }
func main() { func main() {
if err := protect.Pledge("stdio"); err != nil {
panic(err)
}
threads := runtime.GOMAXPROCS(0) threads := runtime.GOMAXPROCS(0)
fmt.Println("Threads:", threads) fmt.Println("Threads:", threads)
start := time.Now() start := time.Now()

12
cmd/yggdrasilctl/main.go
View file

@ -13,6 +13,8 @@ import (
"strings" "strings"
"time" "time"
"suah.dev/protect"
"github.com/olekukonko/tablewriter" "github.com/olekukonko/tablewriter"
"github.com/yggdrasil-network/yggdrasil-go/src/admin" "github.com/yggdrasil-network/yggdrasil-go/src/admin"
"github.com/yggdrasil-network/yggdrasil-go/src/core" "github.com/yggdrasil-network/yggdrasil-go/src/core"
@ -22,6 +24,11 @@ import (
) )
func main() { func main() {
// read config, speak DNS/TCP and/or over a UNIX socket
if err := protect.Pledge("stdio rpath inet unix dns"); err != nil {
panic(err)
}
// makes sure we can use defer and still return an error code to the OS // makes sure we can use defer and still return an error code to the OS
os.Exit(run()) os.Exit(run())
} }
@ -78,6 +85,11 @@ func run() int {
panic(err) panic(err)
} }
// config and socket are done, work without unprivileges
if err := protect.Pledge("stdio"); err != nil {
panic(err)
}
logger.Println("Connected") logger.Println("Connected")
defer conn.Close() defer conn.Close()