add OpenBSD unveil support

The unveil() system call first appeared in OpenBSD 6.4.

For stagit it has the following properties now:

- stagit-index: only read-access to the file-system for the specified
  directories/repositories.
- stagit: read-access to the specified directory/repository.
  read-write and creation access to the current directory for the output files.
  read-write and creation access to the specified cache file.

diff --git a/stagit-index.c b/stagit-index.c
index cc70e4de0adf31bc4705fa58204cbafbb14d8b5f..9a1f9029f0ab12726062562280c27856b4503a6b 100644 (file)
--- a/stagit-index.c
+++ b/stagit-index.c
@@ -159,6 +159,9 @@ main(int argc, char *argv[])
        git_libgit2_init();
 
 #ifdef __OpenBSD__
+       for (i = 1; i < argc; i++)
+               if (unveil(argv[i], "r") == -1)
+                       err(1, "unveil: %s", argv[i]);
        if (pledge("stdio rpath", NULL) == -1)
                err(1, "pledge");
 #endif

diff --git a/stagit.c b/stagit.c
index a6cfebc043b62d54695612a0482ff097a061fb2e..dcac01609fd98046eb1c3503f36f12a1f393a7da 100644 (file)
--- a/stagit.c
+++ b/stagit.c
@@ -1095,6 +1095,13 @@ main(int argc, char *argv[])
        git_libgit2_init();
 
 #ifdef __OpenBSD__
+       if (unveil(repodir, "r") == -1)
+               err(1, "unveil: %s", repodir);
+       if (unveil(".", "rwc") == -1)
+               err(1, "unveil: .");
+       if (cachefile && unveil(cachefile, "rwc") == -1)
+               err(1, "unveil: %s", cachefile);
+
        if (cachefile) {
                if (pledge("stdio rpath wpath cpath fattr", NULL) == -1)
                        err(1, "pledge");