commit 6406877

Usage of unveil() and pledge() can be disabled from config.

 1@@ -87,17 +87,24 @@ int srv_open(char *basedir, int auto_upgrade)
 2         srv_log(error);
 3 
 4 #ifdef __OpenBSD__
 5-    srv_debug(2, xs_fmt("Calling unveil()"));
 6-    unveil(basedir,                "rwc");
 7-    unveil("/usr/sbin/sendmail",   "x");
 8-    unveil("/etc/resolv.conf",     "r");
 9-    unveil("/etc/hosts",           "r");
10-    unveil("/etc/ssl/openssl.cnf", "r");
11-    unveil("/etc/ssl/cert.pem",    "r");
12-    unveil("/usr/share/zoneinfo",  "r");
13-    unveil(NULL,                   NULL);
14-    srv_debug(2, xs_fmt("Calling pledge()"));
15-    pledge("stdio rpath wpath cpath flock inet proc exec dns", NULL);
16+    char *v = xs_dict_get(srv_config, "disable_openbsd_security");
17+
18+    if (v && xs_type(v) == XSTYPE_TRUE) {
19+        srv_debug(1, xs_dup("OpenBSD security disabled by admin"));
20+    }
21+    else {
22+        srv_debug(1, xs_fmt("Calling unveil()"));
23+        unveil(basedir,                "rwc");
24+        unveil("/usr/sbin/sendmail",   "x");
25+        unveil("/etc/resolv.conf",     "r");
26+        unveil("/etc/hosts",           "r");
27+        unveil("/etc/ssl/openssl.cnf", "r");
28+        unveil("/etc/ssl/cert.pem",    "r");
29+        unveil("/usr/share/zoneinfo",  "r");
30+        unveil(NULL,                   NULL);
31+        srv_debug(1, xs_fmt("Calling pledge()"));
32+        pledge("stdio rpath wpath cpath flock inet proc exec dns", NULL);
33+    }
34 #endif /* __OpenBSD__ */
35 
36     return ret;