Justine Tunney 7cf66bc161 Prevent Make from talking to public Internet ... This change introduces the nointernet() function which may be called to prevent a process and its descendants from communicating with publicly routable Internet addresses. GNU Make has been modified to always call this function. In the future Landlock Make will have a way to whitelist subnets to override this behavior, or disable it entirely. Support is available for Linux only. Our firewall does not require root access. Calling nointernet() will return control to the caller inside a new process that has a SECCOMP BPF filter installed, which traps network related system calls. Your original process then becomes a permanent ptrace() supervisor that monitors all processes and threads descending from the returned child. Whenever a networking system call happens the kernel will stop the process and wakes up the monitor, which then peeks into the child memory to read the sockaddr_in to determine if it's ok. The downside to doing this is that there can be only one supervisor at a time using ptrace() on a process. So this firewall won't be enabled if you run make under strace or inside gdb. It also makes testing tricky.		2022-08-12 21:51:39 -07:00
..
struct	Add more missing libc functionality	2022-08-06 10:50:51 -07:00
accept-nt.c	Reduce makefile dependencies by 10%	2022-06-08 20:01:28 -07:00
accept-sysv.c	Add unix domain socket support to redbean	2022-06-22 03:04:25 -07:00
accept.c	Make signal handling work well across platforms	2022-03-25 07:28:57 -07:00
accept4-sysv.c	Add unix domain socket support to redbean	2022-06-22 03:04:25 -07:00
accept4.c	Make fixes and improvements	2022-06-25 21:09:09 -07:00
alg.h	Perform build and magnum tuning	2021-08-10 10:26:13 -07:00
asanmsghdr.c	Prove that Makefile is fully defined	2022-08-06 04:05:08 -07:00
basesocket.c	Improve synchronization	2022-04-15 15:31:55 -07:00
bind-nt.c	Reduce Makefile dependencies by 4%	2022-05-23 15:07:01 -07:00
bind-sysv.c	Add unix domain socket support to redbean	2022-06-22 03:04:25 -07:00
bind.c	Make fixes and improvements	2022-06-25 21:09:09 -07:00
closesocket-nt.c	Fold LIBC_BITS into LIBC_INTRIN	2022-08-11 12:13:18 -07:00
connect-nt.c	Make fixes and improvements	2022-06-25 21:09:09 -07:00
connect-sysv.c	Add unix domain socket support to redbean	2022-06-22 03:04:25 -07:00
connect.c	Prevent Make from talking to public Internet	2022-08-12 21:51:39 -07:00
dupsockfd.c	Improve synchronization	2022-04-15 15:31:55 -07:00
epoll.c	Reduce makefile dependencies by 10%	2022-06-08 20:01:28 -07:00
epoll.h	Add epoll and do more release readiness changes	2020-11-28 12:01:51 -08:00
fixupnewsockfd.c	Reduce Makefile dependencies by 4%	2022-05-23 15:07:01 -07:00
gethostips.c	Fold LIBC_BITS into LIBC_INTRIN	2022-08-11 12:13:18 -07:00
getpeername-nt.c	Reduce Makefile dependencies by 4%	2022-05-23 15:07:01 -07:00
getpeername-sysv.c	Add unix domain socket support to redbean	2022-06-22 03:04:25 -07:00
getpeername.c	Make fixes and improvements	2022-06-25 21:09:09 -07:00
getsockname-nt.c	Reduce Makefile dependencies by 4%	2022-05-23 15:07:01 -07:00
getsockname-sysv.c	Add unix domain socket support to redbean	2022-06-22 03:04:25 -07:00
getsockname.c	Make fixes and improvements	2022-06-25 21:09:09 -07:00
getsockopt-nt.c	Prove that Makefile is fully defined	2022-08-06 04:05:08 -07:00
getsockopt.c	Add tcp syn packet fingerprinting to redbean	2022-07-17 02:43:49 -07:00
goodsocket.c	Refactor out some duplicated code	2021-08-14 06:17:56 -07:00
goodsocket.internal.h	Refactor out some duplicated code	2021-08-14 06:17:56 -07:00
inet_addr.c	Prove that Makefile is fully defined	2022-08-06 04:05:08 -07:00
inet_aton.c	Prove that Makefile is fully defined	2022-08-06 04:05:08 -07:00
inet_ntoa.c	Prove that Makefile is fully defined	2022-08-06 04:05:08 -07:00
inet_ntop.c	Introduce --strace flag for system call tracing	2022-03-18 18:07:28 -07:00
inet_pton.c	Reduce Makefile dependencies by 4%	2022-05-23 15:07:01 -07:00
internal.h	Prevent Make from talking to public Internet	2022-08-12 21:51:39 -07:00
iovec2nt.c	Remove more nonstandard stuff from cosmopolitan.h	2021-03-01 00:18:23 -08:00
ipclassify.internal.h	Get Cosmopolitan into releasable state	2020-11-25 08:19:00 -08:00
ispublicip.c	Improve ZIP filesystem and change its prefix	2021-08-22 01:11:53 -07:00
kntwsadata.c	Fold LIBC_BITS into LIBC_INTRIN	2022-08-11 12:13:18 -07:00
listen-nt.c	Reduce Makefile dependencies by 4%	2022-05-23 15:07:01 -07:00
listen.c	Reduce Makefile dependencies by 4%	2022-05-23 15:07:01 -07:00
nointernet.c	Prevent Make from talking to public Internet	2022-08-12 21:51:39 -07:00
parseport.c	Add protoent and netent (#209)	2021-07-10 12:36:35 -07:00
ppoll.h	Prove that Makefile is fully defined	2022-08-06 04:05:08 -07:00
pselect.c	Add more missing libc functionality	2022-08-06 10:50:51 -07:00
recv-nt.c	Fold LIBC_BITS into LIBC_INTRIN	2022-08-11 12:13:18 -07:00
recv.c	Reduce Makefile dependencies by 4%	2022-05-23 15:07:01 -07:00
recvfrom-nt.c	Make fixes and improvements	2022-06-25 21:09:09 -07:00
recvfrom.c	Add unix domain socket support to redbean	2022-06-22 03:04:25 -07:00
recvmsg.c	Add unix domain socket support to redbean	2022-06-22 03:04:25 -07:00
select-nt.c	Reduce Makefile dependencies by 4%	2022-05-23 15:07:01 -07:00
select.c	Improve system calls	2022-07-08 06:42:03 -07:00
select.h	Add more missing libc functionality	2022-08-06 10:50:51 -07:00
send-nt.c	Make fixes and improvements	2022-06-25 21:09:09 -07:00
send.c	Fix bugs and add security features to redbean	2022-04-18 00:01:26 -07:00
sendfile.c	Fold LIBC_BITS into LIBC_INTRIN	2022-08-11 12:13:18 -07:00
sendfile.internal.h	Reduce Makefile dependencies by 4%	2022-05-23 15:07:01 -07:00
sendmsg.c	Add unix domain socket support to redbean	2022-06-22 03:04:25 -07:00
sendto-nt.c	Make fixes and improvements	2022-06-25 21:09:09 -07:00
sendto.c	Prevent Make from talking to public Internet	2022-08-12 21:51:39 -07:00
setsockopt-nt.c	Prove that Makefile is fully defined	2022-08-06 04:05:08 -07:00
setsockopt.c	Add tcp syn packet fingerprinting to redbean	2022-07-17 02:43:49 -07:00
shutdown-nt.c	Reduce Makefile dependencies by 4%	2022-05-23 15:07:01 -07:00
shutdown.c	Reduce Makefile dependencies by 4%	2022-05-23 15:07:01 -07:00
sock.h	Prevent Make from talking to public Internet	2022-08-12 21:51:39 -07:00
sock.mk	Fold LIBC_BITS into LIBC_INTRIN	2022-08-11 12:13:18 -07:00
sockaddr2bsd.c	Add unix domain socket support to redbean	2022-06-22 03:04:25 -07:00
sockaddr2linux.c	Add unix domain socket support to redbean	2022-06-22 03:04:25 -07:00
sockdebug.c	Add more missing libc functionality	2022-08-06 10:50:51 -07:00
socket-nt.c	Reduce makefile dependencies by 10%	2022-06-08 20:01:28 -07:00
socket-sysv.c	Have redbean show zip listing as default / handler	2021-03-29 01:22:49 -07:00
socket.c	Make fixes and improvements	2022-06-25 21:09:09 -07:00
socketpair-nt.c	Reduce makefile dependencies by 10%	2022-06-08 20:01:28 -07:00
socketpair-sysv.c	Perform fine-tuning of socketpair and pipe	2021-03-16 22:44:54 -07:00
socketpair.c	Strengthen the pledge() polyfill	2022-06-27 13:02:17 -07:00
sys_sendfile_freebsd.S	Reduce Makefile dependencies by 4%	2022-05-23 15:07:01 -07:00
sys_sendfile_xnu.S	Reduce Makefile dependencies by 4%	2022-05-23 15:07:01 -07:00
syscall_fd.internal.h	Reduce Makefile dependencies by 4%	2022-05-23 15:07:01 -07:00
syslog.c	Fold LIBC_BITS into LIBC_INTRIN	2022-08-11 12:13:18 -07:00
syslog.h	Add more missing libc functionality	2022-08-06 10:50:51 -07:00
winsockblock.c	Make fixes and improvements	2022-06-25 21:09:09 -07:00
wsablock.c	Make fixes and improvements	2022-06-25 21:09:09 -07:00
xinet_ntop.c	Fold LIBC_BITS into LIBC_INTRIN	2022-08-11 12:13:18 -07:00
yoink.inc	Improve synchronization	2022-04-15 15:31:55 -07:00