blob: 562d239aff06283bb8f64fdec1344bda9ff1df1e (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
|
// +build openbsd
package main
import (
"fmt"
"log"
"strings"
"golang.org/x/sys/unix"
"tildegit.org/andinus/cetus/cache"
)
func main() {
unveil()
app()
}
func unveil() {
unveilL := make(map[string]string)
unveilL[cache.GetDir()] = "rw"
unveilL["/dev/null"] = "rw" // required by feh
unveilL["/etc/resolv.conf"] = "r"
// ktrace output
unveilL["/usr/libexec/ld.so"] = "r"
unveilL["/var/run/ld.so.hints"] = "r"
unveilL["/usr/lib/libpthread.so.26.1"] = "r"
unveilL["/usr/lib/libc.so.95.1"] = "r"
unveilL["/dev/urandom"] = "r"
unveilL["/etc/mdns.allow"] = "r"
unveilL["/etc/hosts"] = "r"
unveilL["/usr/local/etc/ssl/cert.pem"] = "r"
unveilL["/etc/ssl/cert.pem"] = "r"
unveilL["/etc/ssl/certs"] = "r"
unveilL["/system/etc/security/cacerts"] = "r"
unveilL["/usr/local/share/certs"] = "r"
unveilL["/etc/pki/tls/certs"] = "r"
unveilL["/etc/openssl/certs"] = "r"
unveilL["/var/ssl/certs"] = "r"
for k, v := range unveilL {
err = unix.Unveil(k, v)
if err != nil && err.Error() != "no such file or directory" {
log.Fatal(fmt.Sprintf("%s :: %s\n%s", k, v,
err.Error()))
}
}
err = unveilCmd("feh")
if err != nil {
log.Fatal(err)
}
// Block further unveil calls
err = unix.UnveilBlock()
if err != nil {
log.Fatal(err)
}
}
// unveilCmd will unveil commands.
func unveilCmd(cmd string) error {
pathList := strings.Split(getEnv("PATH", ""), ":")
for _, path := range pathList {
err = unix.Unveil(fmt.Sprintf("%s/%s", path, cmd), "rx")
if err != nil && err.Error() != "no such file or directory" {
return err
}
}
return nil
}
|