yggdrasil-network/yggdrasil-go
1
0
Fork 0
mirror of https://github.com/yggdrasil-network/yggdrasil-go.git synced 2025-04-28 22:25:07 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Use unveil(2) on OpenBSD

Browse source 
After #1175 removed ioctl(2) fallback code shelling out to ifconfig(8),
there is no code left (compiled on OpenBSD) that would fork(2) or execve(2).

Drop the ability to run any executable file to double down on this, thus
reducing the attack surface of this this experimental, internet facing
daemon running as root.

pledge(2) is doable, but needs more polish.
unveil(2), however, is as simple as it gets.

On other systems, this code is a NOOP, but can still help to implement
similar safety belts.
This commit is contained in:
Klemens Nanni 2024-10-23 00:37:31 +03:00
parent eef613993f
commit b16a3b0d43
3 changed files with 19 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
go.mod
View file

@ -45,4 +45,5 @@ require (
github.com/mattn/go-runewidth v0.0.15 // indirect
github.com/olekukonko/tablewriter v0.0.5
github.com/vishvananda/netns v0.0.4 // indirect
suah.dev/protect v1.2.4
)