Strengthen the pledge() polyfill

test/libc/bits/bextra_test.c

@@ -17,9 +17,14 @@
 │ PERFORMANCE OF THIS SOFTWARE.                                                │
 ╚─────────────────────────────────────────────────────────────────────────────*/
 #include "libc/bits/bits.h"
+#include "libc/calls/calls.h"
 #include "libc/testlib/ezbench.h"
 #include "libc/testlib/testlib.h"
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath", 0);
+}
+
 unsigned P[] = {
     // 33333222222222111111111000000000
     0b000011000000010000000001000000000,  //
@@ -106,7 +111,5 @@ TEST(bextra, 9bit) {
 }
 
 BENCH(bextra, bench) {
-  EZBENCH2("bextra 0/32", donothing, bextra(P, 0, 32));
   EZBENCH2("bextra 1/31", donothing, bextra(P, 1, 31));
-  EZBENCH2("bextra 1/32", donothing, bextra(P, 1, 32));
 }

test/libc/bits/bitreverse_test.c

@@ -17,9 +17,14 @@
 │ PERFORMANCE OF THIS SOFTWARE.                                                │
 ╚─────────────────────────────────────────────────────────────────────────────*/
 #include "libc/bits/bits.h"
+#include "libc/calls/calls.h"
 #include "libc/testlib/ezbench.h"
 #include "libc/testlib/testlib.h"
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath", 0);
+}
+
 TEST(bitreverse, test) {
   EXPECT_EQ(0xde, BITREVERSE8(123));
   EXPECT_EQ(0xde, bitreverse8(123));

test/libc/bits/countbits_test.c

@@ -18,12 +18,17 @@
 ╚─────────────────────────────────────────────────────────────────────────────*/
 #include "libc/bits/bits.h"
 #include "libc/bits/popcnt.h"
+#include "libc/calls/calls.h"
 #include "libc/mem/mem.h"
 #include "libc/runtime/gc.internal.h"
 #include "libc/testlib/ezbench.h"
 #include "libc/testlib/hyperion.h"
 #include "libc/testlib/testlib.h"
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath", 0);
+}
+
 TEST(_countbits, testLow) {
   int i;
   char p[2];

test/libc/bits/morton_test.c

@@ -17,11 +17,16 @@
 │ PERFORMANCE OF THIS SOFTWARE.                                                │
 ╚─────────────────────────────────────────────────────────────────────────────*/
 #include "libc/bits/morton.h"
+#include "libc/calls/calls.h"
 #include "libc/nexgen32e/kcpuids.h"
 #include "libc/str/str.h"
 #include "libc/testlib/ezbench.h"
 #include "libc/testlib/testlib.h"
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath", 0);
+}
+
 TEST(morton, test) {
   EXPECT_EQ(0, morton(0, 0));
   EXPECT_EQ(1, morton(0, 1));

test/libc/bits/test.mk

@@ -24,11 +24,13 @@ TEST_LIBC_BITS_CHECKS =					\
 
 TEST_LIBC_BITS_DIRECTDEPS =				\
 	LIBC_BITS					\
+	LIBC_FMT					\
 	LIBC_INTRIN					\
 	LIBC_MEM					\
-	LIBC_RUNTIME					\
 	LIBC_NEXGEN32E					\
+	LIBC_RUNTIME					\
 	LIBC_STUBS					\
+	LIBC_SYSV					\
 	LIBC_TESTLIB					\
 	LIBC_X						\
 	THIRD_PARTY_COMPILER_RT

test/libc/calls/access_test.c

@@ -29,6 +29,10 @@
 
 char testlib_enable_tmp_setup_teardown;
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath wpath cpath fattr", 0);
+}
+
 TEST(access, efault) {
   ASSERT_SYS(EFAULT, -1, access(0, F_OK));
   if (IsWindows() && !IsAsan()) return;  // not possible

test/libc/calls/chdir_test.c

@@ -24,6 +24,10 @@
 
 char testlib_enable_tmp_setup_teardown;
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath wpath cpath fattr", 0);
+}
+
 TEST(chdir, efault) {
   ASSERT_SYS(EFAULT, -1, chdir(0));
   if (IsWindows() && !IsAsan()) return;  // not possible

test/libc/calls/commandv_test.c

@@ -39,6 +39,10 @@ char tmp[PATH_MAX];
 char pathbuf[PATH_MAX];
 char testlib_enable_tmp_setup_teardown;
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath wpath cpath fattr", 0);
+}
+
 void SetUp(void) {
   static int x;
   mkdir("bin", 0755);

test/libc/calls/dup_test.c

@@ -32,6 +32,10 @@
 
 char testlib_enable_tmp_setup_teardown;
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath wpath cpath fattr proc exec", 0);
+}
+
 static textstartup void TestInit(int argc, char **argv) {
   int fd;
   if (argc == 2 && !strcmp(argv[1], "boop")) {

test/libc/calls/execve_test.c

@@ -32,6 +32,11 @@ STATIC_YOINK("zip_uri_support");
 int ws, pid;
 char testlib_enable_tmp_setup_teardown;
 
+__attribute__((__constructor__)) static void init(void) {
+  // TODO(jart): what's up with rhel5 / rhel7?
+  // pledge("stdio rpath wpath cpath fattr proc exec", 0);
+}
+
 bool UsingBinfmtMisc(void) {
   return fileexists("/proc/sys/fs/binfmt_misc/APE");
 }

test/libc/calls/fcntl_test.c

@@ -30,6 +30,10 @@
 
 char testlib_enable_tmp_setup_teardown;
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath wpath cpath fattr", 0);
+}
+
 TEST(fcntl_getfl, testRemembersAccessMode) {
   int fd;
   ASSERT_NE(-1, (fd = open("foo", O_CREAT | O_RDWR, 0644)));

test/libc/calls/fileexists_test.c

@@ -23,6 +23,10 @@
 
 char testlib_enable_tmp_setup_teardown;
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath wpath cpath fattr", 0);
+}
+
 TEST(fileexists, test) {
   EXPECT_SYS(0, 0, fileexists("doge"));
   EXPECT_SYS(0, 0, isdirectory("doge"));

test/libc/calls/ftruncate_test.c

@@ -31,6 +31,10 @@ int64_t fd;
 struct stat st;
 const char *path;
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath wpath cpath", 0);
+}
+
 TEST(ftruncate, test) {
   mkdir("o", 0755);
   mkdir("o/tmp", 0755);

test/libc/calls/getcwd_test.c

@@ -28,6 +28,10 @@
 
 char testlib_enable_tmp_setup_teardown;
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath cpath fattr", 0);
+}
+
 TEST(getcwd, test) {
   char buf[PATH_MAX];
   EXPECT_SYS(0, 0, mkdir("subdir", 0755));

test/libc/calls/lseek_test.c

@@ -27,6 +27,10 @@
 
 char testlib_enable_tmp_setup_teardown;
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath wpath cpath fattr proc", 0);
+}
+
 TEST(lseek, wat) {
   int fd, pid;
   char buf[8] = {0};

test/libc/calls/mkdir_test.c

@@ -30,6 +30,10 @@
 
 char testlib_enable_tmp_setup_teardown;
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath wpath cpath fattr", 0);
+}
+
 void SetUp(void) {
   errno = 0;
 }

test/libc/calls/open_test.c

@@ -27,6 +27,10 @@
 
 char testlib_enable_tmp_setup_teardown;
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath wpath cpath fattr", 0);
+}
+
 TEST(open, efault) {
   ASSERT_SYS(EFAULT, -1, open(0, O_RDONLY));
   if (IsWindows() && !IsAsan()) return;  // not possible

test/libc/calls/pread_test.c

@@ -20,10 +20,13 @@
 #include "libc/sysv/consts/o.h"
 #include "libc/testlib/testlib.h"
 
+int fd;
+char buf[8];
 char testlib_enable_tmp_setup_teardown;
 
-static int fd;
-static char buf[8];
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath wpath cpath fattr", 0);
+}
 
 TEST(dog, testReadPastEof_returnsZero) {
   EXPECT_NE(-1, (fd = open("a", O_RDWR | O_CREAT | O_TRUNC, 0644)));

test/libc/calls/printargs_test.c

@@ -22,6 +22,10 @@
 #include "libc/testlib/testlib.h"
 #include "libc/x/x.h"
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath tty", 0);
+}
+
 /**
  * @fileoverview platform arguments tool
  *

test/libc/calls/readlinkat_test.c

@@ -32,6 +32,10 @@
 
 char testlib_enable_tmp_setup_teardown;
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath wpath cpath fattr", 0);
+}
+
 TEST(readlink, enoent) {
   char buf[32];
   ASSERT_SYS(ENOENT, -1, readlink("doesnotexist", buf, 32));

test/libc/calls/renameat_test.c

@@ -24,6 +24,10 @@
 
 char testlib_enable_tmp_setup_teardown;
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath wpath cpath fattr", 0);
+}
+
 TEST(rename, enoent) {
   EXPECT_SYS(ENOENT, -1, rename("foo", ""));
   EXPECT_SYS(ENOENT, -1, rename("", "foo"));

test/libc/calls/seccomp_test.c

@@ -33,6 +33,10 @@
 #include "libc/testlib/testlib.h"
 #include "tool/net/sandbox.h"
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath proc", 0);
+}
+
 // It's been reported that Chromebooks return EINVAL here.
 bool CanUseSeccomp(void) {
   int ws, pid;

test/libc/calls/setitimer_test.c

@@ -30,6 +30,10 @@
 
 bool gotsig;
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath", 0);
+}
+
 void OnSigAlrm(int sig, siginfo_t *si, ucontext_t *ctx) {
   EXPECT_EQ(SIGALRM, sig);
   EXPECT_EQ(SIGALRM, si->si_signo);

test/libc/calls/sigaction_test.c

@@ -31,9 +31,12 @@
 #include "third_party/xed/x86.h"
 
 struct sigaction oldsa;
-
 volatile bool gotsigint;
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath proc", 0);
+}
+
 void OnSigInt(int sig) {
   CheckStackIsAligned();
   gotsigint = true;

test/libc/calls/signal_test.c

@@ -28,6 +28,10 @@ testonly void OnUsr1(int sig) {
   _exit(0);
 }
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath proc", 0);
+}
+
 TEST(signal, test) {
   ASSERT_NE(SIG_ERR, signal(SIGUSR1, OnUsr1));
   ASSERT_NE(-1, raise(SIGUSR1));

test/libc/calls/sigprocmask_test.c

@@ -28,6 +28,10 @@
 
 volatile int n;
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath proc", 0);
+}
+
 void OnSig(int sig, siginfo_t *si, ucontext_t *ctx) {
   ++n;
 }

test/libc/calls/stat_test.c

@@ -36,6 +36,10 @@ STATIC_YOINK("zip_uri_support");
 
 char testlib_enable_tmp_setup_teardown;
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath wpath cpath fattr", 0);
+}
+
 TEST(stat_010, testEmptyFile_sizeIsZero) {
   struct stat st;
   memset(&st, -1, sizeof(st));

test/libc/calls/symlinkat_test.c

@@ -30,6 +30,10 @@ char testlib_enable_tmp_setup_teardown;
 char p[2][PATH_MAX];
 struct stat st;
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath wpath cpath fattr", 0);
+}
+
 TEST(symlink, enoent) {
   ASSERT_SYS(ENOENT, -1, symlink("o/foo", ""));
   ASSERT_SYS(ENOENT, -1, symlink("o/foo", "o/bar"));

test/libc/calls/unlinkat_test.c

@@ -23,6 +23,10 @@
 
 char testlib_enable_tmp_setup_teardown;
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath wpath cpath fattr", 0);
+}
+
 TEST(unlink, efault) {
   ASSERT_SYS(EFAULT, -1, unlink(0));
   if (IsWindows() && !IsAsan()) return;  // not possible

test/libc/calls/utimensat_test.c

@@ -29,6 +29,10 @@
 
 char testlib_enable_tmp_setup_teardown;
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath wpath cpath fattr", 0);
+}
+
 TEST(utimensat, test) {
   struct stat st;
   struct timespec ts[2] = {

test/libc/calls/writev_test.c

@@ -31,6 +31,10 @@
 
 char testlib_enable_tmp_setup_teardown;
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath wpath cpath fattr", 0);
+}
+
 TEST(writev, test) {
   int fd;
   char ba[1] = "a";

test/libc/dns/comparednsnames_test.c

@@ -16,11 +16,16 @@
 │ TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR             │
 │ PERFORMANCE OF THIS SOFTWARE.                                                │
 ╚─────────────────────────────────────────────────────────────────────────────*/
+#include "libc/calls/calls.h"
 #include "libc/dns/dns.h"
 #include "libc/mem/mem.h"
 #include "libc/str/str.h"
 #include "libc/testlib/testlib.h"
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath", 0);
+}
+
 TEST(CompareDnsNames, testEmpty) {
   char *A = strcpy(malloc(1), "");
   char *B = strcpy(malloc(1), "");

test/libc/mem/malloc_test.c

@@ -45,6 +45,10 @@ void SetUp(void) {
   if (IsWindows()) exit(0);
 }
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath", 0);
+}
+
 TEST(malloc, zeroMeansOne) {
   ASSERT_GE(malloc_usable_size(gc(malloc(0))), 1);
 }

test/libc/mem/pledge_test.c

@@ -18,15 +18,35 @@
 ╚─────────────────────────────────────────────────────────────────────────────*/
 #include "libc/calls/calls.h"
 #include "libc/calls/internal.h"
+#include "libc/calls/ioctl.h"
+#include "libc/calls/struct/bpf.h"
+#include "libc/calls/struct/filter.h"
+#include "libc/calls/struct/flock.h"
+#include "libc/calls/struct/seccomp.h"
+#include "libc/calls/struct/stat.h"
 #include "libc/calls/syscall_support-sysv.internal.h"
 #include "libc/dce.h"
 #include "libc/errno.h"
 #include "libc/mem/mem.h"
 #include "libc/runtime/runtime.h"
+#include "libc/sock/sock.h"
+#include "libc/sock/struct/sockaddr.h"
+#include "libc/sysv/consts/af.h"
+#include "libc/sysv/consts/at.h"
+#include "libc/sysv/consts/f.h"
+#include "libc/sysv/consts/fio.h"
+#include "libc/sysv/consts/ipproto.h"
+#include "libc/sysv/consts/map.h"
+#include "libc/sysv/consts/nrlinux.h"
 #include "libc/sysv/consts/o.h"
+#include "libc/sysv/consts/pr.h"
+#include "libc/sysv/consts/prot.h"
 #include "libc/sysv/consts/sig.h"
+#include "libc/sysv/consts/sock.h"
 #include "libc/testlib/testlib.h"
 
+char testlib_enable_tmp_setup_teardown;
+
 void SetUp(void) {
   if (!__is_linux_2_6_23() && !IsOpenbsd()) {
     exit(0);
@@ -62,3 +82,175 @@ TEST(pledge, stdio_forbidsOpeningPasswd) {
     EXPECT_EQ(SIGABRT, WTERMSIG(ws));
   }
 }
+
+TEST(pledge, stdio_fcntl_allowsSomeFirstArgs) {
+  if (IsOpenbsd()) return;  // b/c testing linux bpf
+  int ws, pid;
+  struct flock lk;
+  ASSERT_NE(-1, (pid = fork()));
+  if (!pid) {
+    ASSERT_SYS(0, 0, pledge("stdio", 0));
+    ASSERT_NE(-1, fcntl(0, F_GETFL));
+    ASSERT_SYS(0, 0, fcntl(0, F_GETFD));
+    ASSERT_SYS(0, 3, fcntl(2, F_DUPFD_CLOEXEC, 3));
+    ASSERT_SYS(0, 0, ioctl(0, FIOCLEX, 0));
+    ASSERT_SYS(EPERM, 0, isatty(0));
+    ASSERT_SYS(EPERM, -1, fcntl(0, -1));
+    ASSERT_SYS(EPERM, -1, fcntl(0, F_GETLK, &lk));
+    ASSERT_SYS(EPERM, -1, fcntl(0, F_NOTIFY));
+    ASSERT_SYS(EPERM, -1, socket(AF_INET, SOCK_STREAM, IPPROTO_TCP));
+    _Exit(0);
+  }
+  EXPECT_NE(-1, wait(&ws));
+  EXPECT_TRUE(WIFEXITED(ws) && !WEXITSTATUS(ws));
+}
+
+TEST(pledge, stdioTty_sendtoRestricted_requiresNullAddr) {
+  if (IsOpenbsd()) return;  // b/c testing linux bpf
+  int ws, pid, sv[2];
+  struct sockaddr_in sa = {AF_UNIX};
+  ASSERT_SYS(0, 0, socketpair(AF_UNIX, SOCK_STREAM, 0, sv));
+  ASSERT_NE(-1, (pid = fork()));
+  if (!pid) {
+    ASSERT_SYS(0, 0, pledge("stdio tty", 0));
+    ASSERT_SYS(0, 5, send(sv[0], "hello", 5, 0));
+    ASSERT_SYS(0, 5, sendto(sv[0], "hello", 5, 0, 0, 0));
+    isatty(0);
+    ASSERT_NE(EPERM, errno);
+    errno = 0;
+    ASSERT_SYS(EPERM, -1, sendto(sv[0], "hello", 5, 0, &sa, sizeof(sa)));
+    _Exit(0);
+  }
+  close(sv[0]);
+  close(sv[1]);
+  EXPECT_NE(-1, wait(&ws));
+  EXPECT_TRUE(WIFEXITED(ws) && !WEXITSTATUS(ws));
+}
+
+TEST(pledge, unix_forbidsInetSockets) {
+  if (IsOpenbsd()) return;  // b/c testing linux bpf
+  int ws, pid;
+  ASSERT_NE(-1, (pid = fork()));
+  if (!pid) {
+    ASSERT_SYS(0, 0, pledge("stdio unix", 0));
+    ASSERT_SYS(0, 3, socket(AF_UNIX, SOCK_STREAM, 0));
+    ASSERT_SYS(EPERM, -1, socket(AF_INET, SOCK_STREAM, IPPROTO_TCP));
+    ASSERT_SYS(EPERM, -1, socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP));
+    _Exit(0);
+  }
+  EXPECT_NE(-1, wait(&ws));
+  EXPECT_TRUE(WIFEXITED(ws) && !WEXITSTATUS(ws));
+}
+
+TEST(pledge, inet_forbidsOtherSockets) {
+  if (IsOpenbsd()) return;  // b/c testing linux bpf
+  int ws, pid;
+  ASSERT_NE(-1, (pid = fork()));
+  if (!pid) {
+    ASSERT_SYS(0, 0, pledge("stdio inet", 0));
+    ASSERT_SYS(0, 3, socket(AF_INET, SOCK_STREAM, IPPROTO_TCP));
+    ASSERT_SYS(0, 4, socket(AF_INET6, SOCK_DGRAM, IPPROTO_UDP));
+    ASSERT_SYS(EPERM, -1, socket(AF_UNIX, SOCK_STREAM, 0));
+    ASSERT_SYS(EPERM, -1, socket(AF_BLUETOOTH, SOCK_STREAM, 0));
+    _Exit(0);
+  }
+  EXPECT_NE(-1, wait(&ws));
+  EXPECT_TRUE(WIFEXITED(ws) && !WEXITSTATUS(ws));
+}
+
+TEST(pledge, mmap) {
+  if (IsOpenbsd()) return;  // b/c testing linux bpf
+  char *p;
+  int ws, pid;
+  ASSERT_NE(-1, (pid = fork()));
+  if (!pid) {
+    ASSERT_SYS(0, 0, pledge("stdio", 0));
+    ASSERT_NE(MAP_FAILED, (p = mmap(0, FRAMESIZE, PROT_READ | PROT_WRITE,
+                                    MAP_ANONYMOUS | MAP_PRIVATE, -1, 0)));
+    ASSERT_SYS(0, 0, mprotect(p, FRAMESIZE, PROT_READ));
+    ASSERT_SYS(EPERM, MAP_FAILED,
+               mprotect(p, FRAMESIZE, PROT_READ | PROT_EXEC));
+    ASSERT_SYS(EPERM, MAP_FAILED,
+               mmap(0, FRAMESIZE, PROT_EXEC | PROT_READ,
+                    MAP_ANONYMOUS | MAP_PRIVATE, -1, 0));
+    _Exit(0);
+  }
+  EXPECT_NE(-1, wait(&ws));
+  EXPECT_TRUE(WIFEXITED(ws) && !WEXITSTATUS(ws));
+}
+
+TEST(pledge, msyscall) {
+  if (IsOpenbsd()) return;  // b/c testing linux bpf
+  int ax, ws, pid;
+  ASSERT_NE(-1, (pid = fork()));
+  if (!pid) {
+    ASSERT_SYS(0, 0, pledge("stdio", 0));
+    // now issue authorized syscall where rip isn't privileged
+    asm volatile("syscall"
+                 : "=a"(ax)
+                 : "0"(__NR_linux_dup), "D"(2)
+                 : "rcx", "r11", "memory");
+    _Exit(1);
+  }
+  EXPECT_NE(-1, wait(&ws));
+  EXPECT_TRUE(WIFSIGNALED(ws));
+  EXPECT_EQ(SIGSYS, WTERMSIG(ws));
+}
+
+TEST(pledge, chmod_ignoresDangerBits) {
+  if (IsOpenbsd()) return;  // b/c testing linux bpf
+  int ws, pid;
+  struct stat st;
+  ASSERT_SYS(0, 3, creat("foo", 0644));
+  ASSERT_NE(-1, (pid = fork()));
+  if (!pid) {
+    ASSERT_SYS(0, 0, pledge("stdio rpath", 0));
+    ASSERT_SYS(0, 0, fchmod(3, 00700));
+    ASSERT_SYS(0, 0, chmod("foo", 00700));
+    ASSERT_SYS(0, 0, fchmodat(AT_FDCWD, "foo", 00700, 0));
+    ASSERT_SYS(EPERM, -1, fchmod(3, 07700));
+    ASSERT_SYS(EPERM, -1, chmod("foo", 04700));
+    ASSERT_SYS(EPERM, -1, fchmodat(AT_FDCWD, "foo", 02700, 0));
+    _Exit(0);
+  }
+  EXPECT_NE(-1, wait(&ws));
+  EXPECT_TRUE(WIFEXITED(ws) && !WEXITSTATUS(ws));
+  close(3);
+}
+
+TEST(pledge, open_rpath) {
+  if (IsOpenbsd()) return;  // b/c testing linux bpf
+  int ws, pid;
+  struct stat st;
+  ASSERT_SYS(0, 0, touch("foo", 0644));
+  ASSERT_NE(-1, (pid = fork()));
+  if (!pid) {
+    ASSERT_SYS(0, 0, pledge("stdio rpath", 0));
+    ASSERT_SYS(0, 3, open("foo", O_RDONLY));
+    ASSERT_SYS(EPERM, -1, open("foo", O_RDWR | O_TRUNC | O_CREAT, 0644));
+    ASSERT_SYS(EPERM, -1, open("foo", O_WRONLY | O_TRUNC | O_CREAT, 0644));
+    _Exit(0);
+  }
+  EXPECT_NE(-1, wait(&ws));
+  EXPECT_TRUE(WIFEXITED(ws) && !WEXITSTATUS(ws));
+  close(3);
+}
+
+TEST(pledge, open_wpath) {
+  if (IsOpenbsd()) return;  // b/c testing linux bpf
+  int ws, pid;
+  struct stat st;
+  ASSERT_SYS(0, 0, touch("foo", 0644));
+  ASSERT_NE(-1, (pid = fork()));
+  if (!pid) {
+    ASSERT_SYS(0, 0, pledge("stdio wpath", 0));
+    ASSERT_SYS(0, 3, open("foo", O_RDONLY));
+    ASSERT_SYS(EPERM, -1, open(".", O_RDWR | O_TMPFILE, 07644));
+    ASSERT_SYS(EPERM, -1, open("foo", O_WRONLY | O_TRUNC | O_CREAT, 07644));
+    ASSERT_SYS(0, 4, open("foo", O_WRONLY | O_TRUNC | O_CREAT, 0644));
+    _Exit(0);
+  }
+  EXPECT_NE(-1, wait(&ws));
+  EXPECT_TRUE(WIFEXITED(ws) && !WEXITSTATUS(ws));
+  close(3);
+}

test/libc/mem/test.mk

@@ -37,6 +37,7 @@ TEST_LIBC_MEM_DIRECTDEPS =					\
 	LIBC_NEXGEN32E						\
 	LIBC_RAND						\
 	LIBC_RUNTIME						\
+	LIBC_SOCK						\
 	LIBC_STDIO						\
 	LIBC_STR						\
 	LIBC_STUBS						\

test/libc/runtime/ape_test.c

@@ -32,6 +32,11 @@ STATIC_YOINK("apetest2.com");
 
 char testlib_enable_tmp_setup_teardown_once;
 
+__attribute__((__constructor__)) static void init(void) {
+  // TODO(jart): What's up with RHEL5 / RHEL7?
+  // pledge("stdio rpath wpath cpath tty proc exec", 0);
+}
+
 void Extract(const char *from, const char *to, int mode) {
   ASSERT_SYS(0, 3, open(from, O_RDONLY));
   ASSERT_SYS(0, 4, creat(to, mode));

test/libc/runtime/arch_prctl_test.c

@@ -21,6 +21,10 @@
 #include "libc/dce.h"
 #include "libc/testlib/testlib.h"
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath", 0);
+}
+
 TEST(arch_prctl, fs) {
   if (IsLinux() || IsOpenbsd()) {
     uint64_t n, x;

test/libc/runtime/clone_test.c

@@ -42,6 +42,10 @@ char *stack, *tls;
 int x, me, tid, *childetid;
 _Atomic(int) thechilde;
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath thread", 0);
+}
+
 void SetUp(void) {
   x = 0;
   me = gettid();

test/libc/runtime/fork_test.c

@@ -29,6 +29,10 @@
 #include "libc/testlib/ezbench.h"
 #include "libc/testlib/testlib.h"
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath proc", 0);
+}
+
 TEST(fork, testPipes) {
   int a, b;
   int ws, pid;

test/libc/runtime/memtrack_test.c

@@ -16,6 +16,7 @@
 │ TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR             │
 │ PERFORMANCE OF THIS SOFTWARE.                                                │
 ╚─────────────────────────────────────────────────────────────────────────────*/
+#include "libc/calls/calls.h"
 #include "libc/errno.h"
 #include "libc/intrin/kprintf.h"
 #include "libc/limits.h"
@@ -30,6 +31,10 @@
 #define I(x, y) \
   { x, y, 0, (y - x) * FRAMESIZE + FRAMESIZE }
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath", 0);
+}
+
 static bool AreMemoryIntervalsEqual(const struct MemoryIntervals *mm1,
                                     const struct MemoryIntervals *mm2) {
   if (mm1->i != mm2->i) return false;

test/libc/runtime/mmap_test.c

@@ -48,6 +48,10 @@
 
 char testlib_enable_tmp_setup_teardown;
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath wpath cpath proc", 0);
+}
+
 TEST(mmap, zeroSize) {
   ASSERT_SYS(EINVAL, MAP_FAILED,
              mmap(NULL, 0, PROT_READ, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0));

test/libc/sock/poll_test.c

@@ -37,6 +37,10 @@
 #include "tool/decode/lib/flagger.h"
 #include "tool/decode/lib/pollnames.h"
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath proc inet", 0);
+}
+
 dontdiscard char *FormatPollFd(struct pollfd p[2]) {
   return xasprintf("fd:%d revents:%s\n"
                    "fd:%d revents:%s\n",

test/libc/sock/select_test.c

@@ -23,6 +23,10 @@
 #include "libc/testlib/testlib.h"
 #include "libc/time/time.h"
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath", 0);
+}
+
 // TEST(select, allZero) {
 //  // todo: figure out how to test block until signal w/ select
 //  EXPECT_SYS(0, 0, select(0, 0, 0, 0, 0));

test/libc/sock/setsockopt_test.c

@@ -27,6 +27,10 @@
 #include "libc/sysv/consts/sol.h"
 #include "libc/testlib/testlib.h"
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath inet", 0);
+}
+
 TEST(setsockopt, SO_RCVTIMEO) {
   char buf[32];
   struct timeval tv = {0, 10000};

test/libc/sock/socketpair_test.c

@@ -25,6 +25,10 @@
 #include "libc/sysv/consts/sock.h"
 #include "libc/testlib/testlib.h"
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath tty", 0);
+}
+
 TEST(socketpair, testAfUnixStream) {
   int fd[2];
   const char ping[] = "ping";

test/libc/sock/unix_test.c

@@ -31,6 +31,10 @@
 #include "libc/testlib/testlib.h"
 #include "libc/time/time.h"
 
+__attribute__((__constructor__)) static void init(void) {
+  pledge("stdio rpath cpath proc unix", 0);
+}
+
 char testlib_enable_tmp_setup_teardown;
 
 void DatagramServer(void) {