Klemens Nanni 83ec58afc7

Use unveil(2) on OpenBSD (#1194) ...

After #1175 removed ioctl(2) fallback code shelling out to ifconfig(8),
there is no code left (compiled on OpenBSD) that would fork(2) or
execve(2).

Drop the ability to run any executable file to double down on this, thus
reducing the attack surface of this this experimental, internet facing
daemon running as root.

pledge(2) is doable, but needs more polish.
unveil(2), however, is as simple as it gets.

On other systems, this code is a NOOP, but can still help to implement
similar safety belts.

2024-12-12 18:37:02 +00:00

..

chuser_other.go

argument to change uid/gid (#927)

2024-09-22 15:46:54 +00:00

chuser_unix_test.go

Rewrite chuser() for simplicity and correctness (#1203)

2024-11-17 21:37:07 +00:00

chuser_unix.go

Rewrite chuser() for simplicity and correctness (#1203)

2024-11-17 21:37:07 +00:00

main.go

Use unveil(2) on OpenBSD (#1194)

2024-12-12 18:37:02 +00:00