mirrors/cosmopolitan
1
0
Fork 0
mirror of https://github.com/jart/cosmopolitan.git synced 2025-05-23 13:52:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Extend Pledge with anet (same as inet, but with no connect) (#827)

Browse source 
* Add `anet` pledge for `inet` without connect

This is useful for configurations where it's desirable to start redbean
under these restrictions, but not to allow `connect` socket calls.

* Update message on protected/unpledged syscalls for clarity

* Update redbean to add reporting for unpledged sigaction

Previously it would abort without indicating what signal it failed to
install when sigaction is not pledged (although it fails all of them).

* Move GetHostIps before processing command line options

This allows using unix.pledge as part of the options without affecting
retrieving host IP addresses (which requires `connect`). It may still
fail under external `pledge` command as expected; in this case IPs
would need to be passed manually.

* Update tests for pledge anet promise
This commit is contained in:
Paul Kulchenko 2023-06-03 07:50:29 -07:00 • committed by GitHub
parent 72f8bd10b7
commit 5655c9a4e7
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
7 changed files with 39 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

4
test/libc/calls/pledge2_test.c
View file

@ -79,7 +79,7 @@ TEST(pledge, testLogMessage_inSoftyMode) {
read(fds[0], msg, sizeof(msg));
close(fds[0]);
if (IsLinux()) {
ASSERT_STARTSWITH("error: pledge inet for socket", msg);
ASSERT_STARTSWITH("error: protected syscall socket", msg);
}
}
@ -97,7 +97,7 @@ TEST(pledge, testLogMessage_onKillProcess) {
read(fds[0], msg, sizeof(msg));
close(fds[0]);
if (IsLinux()) {
ASSERT_STARTSWITH("error: pledge inet for socket", msg);
ASSERT_STARTSWITH("error: protected syscall socket", msg);
}
}