Re: add pledge and unveil to net/irssi

On Tue, Jun 11, 2019 at 11:55:29AM -0600, Theo de Raadt wrote:
> Bryan Steele <brynet@gmail.com> wrote:
>
> > In addition to what Stuart said, irssi is using libperl here for perl
> > scripts, which means the irssi unveil will be applied to them. There
> > are many uses for perl scripts, and many involve reading arbitrary files
> > and there's no way to know that upfront.
>
> Keep in mind unveil is different from pledge.
>
> With pledge, you get killed. Unacceptably inconvenient to have that in
> a sustained runtime, when you suddenly trigger a new feature.
>
> With unveil, a hidden file is EACCES or ENOENT therefore a deeply
> complicated feature may *subtly misbehave* if it continues operation
> in the absence of a control file or something.
>
> I think making this a getopt flag is a disaster.
>
> It was done with chrome *temporarily* during test phases, but sustained
> use of flags tied to low-level features is seriously user hostile.
>

The following patch makes the irssi unveiled version a new flavor, with
unveil/pledge optin. I think this is best option. This is optin AND the
package name is explicit, nobody should be surprised of irssi-unveil
blocking some plugins.


Index: Makefile
===================================================================
RCS file: /data/cvs/ports/net/irssi/Makefile,v
retrieving revision 1.79
diff -u -p -r1.79 Makefile
--- Makefile 18 Feb 2019 18:35:57 -0000 1.79
+++ Makefile 12 Jun 2019 09:50:59 -0000
@@ -5,6 +5,7 @@ COMMENT = modular IRC client with many f
V = 1.2.0
DISTNAME = irssi-$V
PKGSPEC = irssi-=$V
+REVISION = 0

CATEGORIES = net

@@ -15,12 +16,13 @@ MAINTAINER = Klemens Nanni <kn@openbsd.o
# GPLv2+
PERMIT_PACKAGE_CDROM = Yes

+# use pledge()
WANTLIB += c crypto curses gcrypt glib-2.0 gmodule-2.0 gpg-error \
iconv intl m otr pcre perl pthread ssl

MASTER_SITES = https://github.com/irssi/irssi/releases/download/${V}/

-FLAVORS = socks
+FLAVORS = socks unveil
FLAVOR ?=

LIB_DEPENDS = devel/glib2>=2.28.0 \
@@ -44,6 +46,13 @@ CONFIGURE_ARGS += --with-socks
LIB_DEPENDS += security/dante
WANTLIB += socks
.endif
+
+.if ${FLAVOR:Munveil}
+CFLAGS += -DHAVE_UNVEIL=y
+.endif
+
+# required for 100% tests to pass
+PORTHOME= ${WRKDIST}

MAKE_FLAGS = scriptdir="${SYSCONFDIR}/irssi/scripts" \
themedir="${SYSCONFDIR}/irssi/themes"
Index: patches/patch-src_core_net-nonblock_c
===================================================================
RCS file: patches/patch-src_core_net-nonblock_c
diff -N patches/patch-src_core_net-nonblock_c
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ patches/patch-src_core_net-nonblock_c 12 Jun 2019 09:59:56 -0000
@@ -0,0 +1,19 @@
+$OpenBSD$
+
+Index: src/core/net-nonblock.c
+--- src/core/net-nonblock.c.orig
++++ src/core/net-nonblock.c
+@@ -60,6 +60,13 @@ int net_gethostbyname_nonblock(const char *addr, GIOCh
+ "Using blocking resolving");
+ }
+
++#ifdef HAVE_UNVEIL
++ if(pledge_enabled()) {
++ if (pledge("dns inet stdio",NULL) == -1)
++ { printf("Error pledge non-block\n"); exit(1); }
++ }
++