Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

unix: use libc stubs for OpenBSD pledge+unveil #146

Closed
wants to merge 4 commits into from
Closed

unix: use libc stubs for OpenBSD pledge+unveil #146

wants to merge 4 commits into from

Commits on Nov 2, 2023

  1. unix: use libc stubs for OpenBSD pledge+unveil 

    For both compatibility and security concerns, it is preferrable to
perform system calls through the libc stubs rather than syscall(2).
Besides making programs resilient to changing system call numbers, it
removes an unnecessary use of the syscall(2) call which, if found by
an attacker, could be abused to perform any system call.

As OpenBSD 6.2 is the oldest supported version of OpenBSD, remove the
handling of pledge on versions prior to this release.

PledgeExecpromises is no longer usable on 6.2, as the execpromises is
treated as required (unlike Pledge, where on 6.2 it is allowed but
must be empty).  The empty execpromises string is no longer converted
to a nil pointer on 6.2.  This fixes an out-of-bounds read where, on
6.2, an empty string would be passed to the deprecated pledge(2) API,
which would interpret the pointer as an array of strings.
    @jrick
    jrick committed Nov 2, 2023
    Configuration menu
    Copy the full SHA
    504bf5b View commit details
    Browse the repository at this point in the history

  2. regenerate syscalls for all openbsd ports

    @jrick
    jrick committed Nov 2, 2023
    Configuration menu
    Copy the full SHA
    56eca24 View commit details
    Browse the repository at this point in the history

  3. remove now unnecessary comment about openbsd <=6.3

    @jrick
    jrick committed Nov 2, 2023
    Configuration menu
    Copy the full SHA
    6607d46 View commit details
    Browse the repository at this point in the history

  4. whack more useless comments

    @jrick
    jrick committed Nov 2, 2023
    Configuration menu
    Copy the full SHA
    ebc0461 View commit details
    Browse the repository at this point in the history