mirrors/cosmopolitan
1
0
Fork 0
mirror of https://github.com/jart/cosmopolitan.git synced 2025-06-26 22:38:30 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Release redbean 2.0.14

Browse source
This commit is contained in:
Justine Tunney 2022-07-22 17:07:25 -07:00
parent 76d2f68c91
commit 742251dd92
3 changed files with 20 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

22
libc/mem/pledge.c
View file

@ -1438,17 +1438,17 @@ int ParsePromises(const char *promises, unsigned long *out) {
* placeholder group for pledge.com, which reads the `__promises` * placeholder group for pledge.com, which reads the `__promises`
* global to determine if /tmp and $TMPPATH should be unveiled. * global to determine if /tmp and $TMPPATH should be unveiled.
* *
* `execpromises` only matters if "exec" or "execnative" are specified * `execpromises` only matters if "exec" is specified in `promises`. In
* in `promises`. In that case, this specifies the promises that'll * that case, this specifies the promises that'll apply once execve()
* apply once execve() happens. If this is NULL then the default is * happens. If this is NULL then the default is used, which is
* used, which is unrestricted. OpenBSD allows child processes to escape * unrestricted. OpenBSD allows child processes to escape the sandbox
* the sandbox (so a pledged OpenSSH server process can do things like * (so a pledged OpenSSH server process can do things like spawn a root
* spawn a root shell). Linux however requires monotonically decreasing * shell). Linux however requires monotonically decreasing privileges.
* privileges. This function will will perform some validation on Linux * This function will will perform some validation on Linux to make sure
* to make sure that `execpromises` is a subset of `promises`. Your libc * that `execpromises` is a subset of `promises`. Your libc wrapper for
* wrapper for execve() will then apply its SECCOMP BPF filter later. * execve() will then apply its SECCOMP BPF filter later. Since Linux
* Since Linux has to do this before calling sys_execve(), the executed * has to do this before calling sys_execve(), the executed process will
* process will be weakened to have execute permissions too. * be weakened to have execute permissions too.
* *
* @return 0 on success, or -1 w/ errno * @return 0 on success, or -1 w/ errno
* @raise ENOSYS if host os isn't Linux or OpenBSD * @raise ENOSYS if host os isn't Linux or OpenBSD

16
tool/net/help.txt
View file

@ -3908,14 +3908,14 @@ UNIX MODULE
such as non-assimilated APE binaries, or programs that link such as non-assimilated APE binaries, or programs that link
dynamic shared objects, i.e. most Linux distro binaries. dynamic shared objects, i.e. most Linux distro binaries.
`execpromises` only matters if "exec" or "execnative" are specified `execpromises` only matters if "exec" is specified in `promises`. In
in `promises`. In that case, this specifies the promises that'll that case, this specifies the promises that'll apply once execve()
apply once execve() happens. If this is NULL then the default is happens. If this is NULL then the default is used, which is
used, which is unrestricted. OpenBSD allows child processes to escape unrestricted. OpenBSD allows child processes to escape the sandbox
the sandbox (so a pledged OpenSSH server process can do things like (so a pledged OpenSSH server process can do things like spawn a root
spawn a root shell). Linux however requires monotonically decreasing shell). Linux however requires monotonically decreasing privileges.
privileges. This function will will perform some validation on Linux This function will will perform some validation on Linux to make
to make sure that `execpromises` is a subset of `promises`. Your libc sure that `execpromises` is a subset of `promises`. Your libc
wrapper for execve() will then apply its SECCOMP BPF filter later. wrapper for execve() will then apply its SECCOMP BPF filter later.
Since Linux has to do this before calling sys_execve(), the executed Since Linux has to do this before calling sys_execve(), the executed
process will be weakened to have execute permissions too. process will be weakened to have execute permissions too.

2
tool/net/redbean.c
View file

@ -149,7 +149,7 @@ STATIC_YOINK("ShowCrashReportsEarly");
#define REDBEAN "redbean" #define REDBEAN "redbean"
#endif #endif
#define VERSION 0x02000d #define VERSION 0x02000e
#define HEARTBEAT 5000 /*ms*/ #define HEARTBEAT 5000 /*ms*/
#define HASH_LOAD_FACTOR /* 1. / */ 4 #define HASH_LOAD_FACTOR /* 1. / */ 4
#define MONITOR_MICROS 150000 #define MONITOR_MICROS 150000