1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
|
#+SETUPFILE: ~/.emacs.d/org-templates/projects.org
#+EXPORT_FILE_NAME: index
#+OPTIONS: toc:2
#+TITLE: Lynx
Lynx is a simple /unveil/ & /pledge/ wrapper. It returns /nil/ on unsupported systems,
currently only /OpenBSD/ is supported.
| Project Home | [[https://andinus.nand.sh/lynx][Lynx]] |
| Source Code | [[https://git.tilde.institute/andinus/lynx][Andinus / Lynx]] |
| GitHub (Mirror) | [[https://github.com/andinus/lynx][Lynx - GitHub]] |
* Why use lynx?
- *UnveilPaths* & *UnveilCommands*: /unix/ package provides simple Unveil syscalls so
this is useful because you don't have to write these functions yourself
manually in every project.
- /lynx/ manages build flags for you, which means that /lynx/ will return nil on
unsupported systems whereas you have handle that yourself in /unix/ package.
*Note*: Unveil, UnveilPaths & UnveilCommands ignore some errors, look at examples
before using them.
* Examples
** UnveilPaths / UnveilPathsStrict
UnveilPaths takes a map of path, permission & unveils them one by one, it will
return an error if unveil fails at any step. "no such file or directory" error
is ignored, if you want to get that error too then use UnveilPathsStrict.
#+BEGIN_SRC go
package main
import "git.tilde.institute/andinus/lynx"
func main() {
paths := make(map[string]string)
paths["/home"] = "r"
paths["/dev/null"] = "rw"
paths["/etc/examples"] = "rwc"
paths["/root"] = "rwcx"
err = lynx.UnveilPaths(paths)
if err != nil {
log.Fatal(err)
}
// This will return an error if the path doesn't exist.
err = lynx.UnveilPathsStrict(paths)
if err != nil {
log.Fatal(err)
}
}
#+END_SRC
** UnveilCommands
UnveilCommands takes a slice of commands & unveils them one by one, it will
return an error if unveil fails at any step. "no such file or directory" error
is ignored because binaries are not placed in every PATH.
Default permission is "rx".
#+BEGIN_SRC go
package main
import "git.tilde.institute/andinus/lynx"
func main() {
commands := []string{"cd", "ls", "rm"}
err = lynx.UnveilCommands(commands)
if err != nil {
log.Fatal(err)
}
}
#+END_SRC
** UnveilBlock
UnveilBlock is just a wrapper around unix.UnveilBlock, it does nothing extra.
You should use unix.UnveilBlock.
#+BEGIN_SRC go
package main
import "git.tilde.institute/andinus/lynx"
func main() {
// Block further unveil calls.
err = lynx.UnveilBlock()
if err != nil {
log.Fatal(err)
}
}
#+END_SRC
** Unveil / UnveilStrict
Unveil takes a path, permission & unveils it, it will return an error if unveil
fails at any step. "no such file or directory" error is ignored, if you want to
get that error too then use UnveilStrict.
#+BEGIN_SRC go
package main
import "git.tilde.institute/andinus/lynx"
func main() {
path := "/dev/null"
flags := "rw"
err = lynx.Unveil(path, flags)
if err != nil {
log.Fatal(err)
}
// This will return an error if the path doesn't exist.
err = lynx.UnveilStrict(path, flags)
if err != nil {
log.Fatal(err)
}
}
#+END_SRC
** Pledge / PledgePromises / PledgeExecpromises
These are simple wrappers to unix package functions. They add nothing extra, you
could simply change lynx.Pledge to unix.Pledge & it would just work.
#+BEGIN_SRC go
package main
import "git.tilde.institute/andinus/lynx"
func main() {
promises := "stdio unveil"
execpromises := "stdio"
err = lynx.Pledge(promises, execpromises)
if err != nil {
log.Fatal(err)
}
// Drop promises.
promises = "stdio"
err = lynx.PledgePromises(promises)
if err != nil {
log.Fatal(err)
}
// Drop execpromises.
execpromises = ""
err = lynx.PledgeExecpromises(execpromises)
if err != nil {
log.Fatal(err)
}
}
#+END_SRC
|