yggdrasil-network/yggdrasil-go
1
0
Fork 0
mirror of https://github.com/yggdrasil-network/yggdrasil-go.git synced 2025-08-24 16:05:07 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

OpenBSD: Pledge full filesystem read for Go's resolv.conf polling

Browse source 
sys/kern/kern_pledge.c r1.329[0] removed the unveil bypass for "dns",
so "rpath" is needed for Go's DNS to stat(2) it.

Since current "/ rwc" and "cpath" with the new "rpath" amount to full
read access, there is no point in unveiling anymore.

0: 8d49ad01ac
This commit is contained in:
Klemens Nanni 2025-08-11 21:57:25 +03:00
parent 429403aea5
commit 3c212584c5
No known key found for this signature in database
1 changed files with 1 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

16
cmd/yggdrasil/main.go
View file

@ -41,20 +41,6 @@ type node struct {
// The main function is responsible for configuring and starting Yggdrasil. // The main function is responsible for configuring and starting Yggdrasil.
func main() { func main() {
// Not all operations are coverable with pledge(2), so immediately
// limit file system access with unveil(2), effectively preventing
// "proc exec" promises right from the start:
//
// - read arbitrary config file
// - create/write arbitrary log file
// - read/write/chmod/remove admin socket, if at all
if err := protect.Unveil("/", "rwc"); err != nil {
panic(fmt.Sprintf("unveil: / rwc: %v", err))
}
if err := protect.UnveilBlock(); err != nil {
panic(fmt.Sprintf("unveil: %v", err))
}
genconf := flag.Bool("genconf", false, "print a new config to stdout") genconf := flag.Bool("genconf", false, "print a new config to stdout")
useconf := flag.Bool("useconf", false, "read HJSON/JSON config from stdin") useconf := flag.Bool("useconf", false, "read HJSON/JSON config from stdin")
useconffile := flag.String("useconffile", "", "read HJSON/JSON config from specified file path") useconffile := flag.String("useconffile", "", "read HJSON/JSON config from specified file path")
@ -319,7 +305,7 @@ func main() {
// //
// Peers, InterfacePeers, Listen can be UNIX sockets; // Peers, InterfacePeers, Listen can be UNIX sockets;
// Go's net.Listen.Close() deletes files on shutdown. // Go's net.Listen.Close() deletes files on shutdown.
promises := []string{"stdio", "cpath", "inet", "unix", "dns"} promises := []string{"stdio", "rpath", "cpath", "inet", "unix", "dns"}
if len(cfg.MulticastInterfaces) > 0 { if len(cfg.MulticastInterfaces) > 0 {
promises = append(promises, "mcast") promises = append(promises, "mcast")
} }