Add capsicum support

It's the sandboxing system of FreeBSD. Quite pleasant to work with.

(Just trying to figure out the basics with this one before tackling the
abomination that is seccomp.)

Indeed, the only non-trivial part was getting newSelector to work with
Capsicum. Long story short it doesn't, so we use an ugly pointer cast +
assignment. But even that is stdlib's "fault", not Capsicum's.

This also gets rid of that ugly SocketPath global.

1 files changed, 2 insertions, 0 deletions

diff --git a/adapter/protocol/http.nim b/adapter/protocol/http.nim
index 25e39330..2bdd6858 100644
--- a/adapter/protocol/http.nim
+++ b/adapter/protocol/http.nim
@@ -4,6 +4,7 @@ else:
   import std/os
 import std/posix
 import std/strutils
+import utils/sandbox
 
 import curl
 import curlerrors
@@ -76,6 +77,7 @@ proc curlPreRequest(clientp: pointer, conn_primary_ip, conn_local_ip: cstring,
   let op = cast[HttpHandle](clientp)
   op.connectreport = true
   puts("Cha-Control: Connected\n")
+  enterSandbox()
   return 0 # ok
 
 proc main() =