e81edf7b04
The pledge.com command now supports the new [WIP] unveil() support. For
example, to strongly sandbox our command for listing directories.
o//tool/build/assimilate.com o//examples/ls.com
pledge.com -v /etc -p 'stdio rpath' o//examples/ls.com /etc
This file system sandboxing is going to be perfect for us, because APE
binaries are self-contained static executables that really don't use the
filesystem that much. On the other hand, with non-static executables,
sandboxing is going to be more difficult. For example, here's how to
sandbox the `ls` command on the latest Alpine:
pledge.com -v rx:/lib -v /usr/lib -v /etc -p 'stdio rpath exec' ls /etc
This change fixes the `execpromises` API with pledge().
This change also adds unix.unveil() to redbean.
Fixes #494
|
||
|---|---|---|
| .. | ||
| calls | ||
| consts | ||
| errfuns | ||
| consts.sh | ||
| describeos.greg.c | ||
| errfun.S | ||
| errfuns.h | ||
| errfuns.sh | ||
| errno.c | ||
| errno_location.greg.c | ||
| gen.sh | ||
| macros.internal.h | ||
| README.md | ||
| restorert.S | ||
| strace.greg.c | ||
| syscall.S | ||
| syscalls.sh | ||
| syscount.S | ||
| systemfive.S | ||
| sysv.mk | ||
SYNOPSIS
System Five Import Libraries
OVERVIEW
Bell System Five is the umbrella term we use to describe Linux, FreeBSD, OpenBSD, and Mac OS X which all have nearly-identical application binary interfaces that stood the test of time, having definitions nearly the same as those of AT&T back in the 1980's.
Cosmopolitan aims to help you build apps that can endure over the course of decades, just like these systems have: without needing to lift a finger for maintenance churn, broken builds, broken hearts.
The challenge to System V binary compatibility basically boils down to numbers. All these systems agree on what services are provided, but tend to grant them wildly different numbers.
We address this by putting all the numbers in a couple big shell scripts, ask the GNU Assembler to encode them into binaries using an efficient LEB128 encoding, unpacked by _init(), and ref'd via extern const. It gives us good debuggability, and any costs are gained back by fewer branches in wrapper functions.z