commit b856664

Tweaked unveil() / pledge() to deal with UNIX sockets.

 1@@ -114,13 +114,12 @@ int srv_open(const char *basedir, int auto_upgrade)
 2 #endif
 3 
 4 #ifdef __OpenBSD__
 5-    const char *v = xs_dict_get(srv_config, "disable_openbsd_security");
 6-
 7-    if (v && xs_type(v) == XSTYPE_TRUE) {
 8+    if (xs_is_true(xs_dict_get(srv_config, "disable_openbsd_security"))) {
 9         srv_debug(1, xs_dup("OpenBSD security disabled by admin"));
10     }
11     else {
12-        int smail = xs_type(xs_dict_get(srv_config, "disable_email_notifications")) != XSTYPE_TRUE;
13+        int smail = !xs_is_true(xs_dict_get(srv_config, "disable_email_notifications"));
14+        const char *address = xs_dict_get(srv_config, "address");
15 
16         srv_debug(1, xs_fmt("Calling unveil()"));
17         unveil(basedir,                "rwc");
18@@ -134,13 +133,22 @@ int srv_open(const char *basedir, int auto_upgrade)
19         if (smail)
20             unveil("/usr/sbin/sendmail",   "x");
21 
22+        if (*address == '/')
23+            unveil(address, "rwc");
24+
25         unveil(NULL,                   NULL);
26+
27         srv_debug(1, xs_fmt("Calling pledge()"));
28 
29+        xs *p = xs_str_new("stdio rpath wpath cpath flock inet proc dns fattr");
30+
31         if (smail)
32-            pledge("stdio rpath wpath cpath flock inet proc exec dns fattr", NULL);
33-        else
34-            pledge("stdio rpath wpath cpath flock inet proc dns fattr", NULL);
35+            p = xs_str_cat(p, " exec");
36+
37+        if (*address == '/')
38+            p = xs_str_cat(p, " unix");
39+
40+        pledge(p, NULL);
41     }
42 #endif /* __OpenBSD__ */
43