Re: add pledge and unveil to net/irssi

On Fri, Jun 07, 2019 at 07:25:45PM +0100, Stuart Henderson wrote:
> On 2019/06/07 19:05, Solene Rapenne wrote:
> > Hi,
> >
> > This is a first draft to add pledge and unveil to net/irssi.
> >
> > About the Makefile, I added PORTHOME=${WRKDIST} so "make test" run with
> > 100% of success.
> >
> > The current implementation of pledge/unveil is under a #ifdef
> > HAVE_PLEDGE so I defined it there.
>
> Nothing is calling pledge_init (I noticed because there's no "p" flag
> showing in ps, and to be honest also because it didn't crash like I was
> expecting it to with my configuration ;-)

one patch was missing :(

full patch below, I reapplied it on a fresh net/irssi folder and I can
see the "p" state in ps

The security features can be disabled (a bit of work is required to
disable the pledge in net-nonblock.c (you should already have it enabled
when you were connected)) so people requiring plugins not working can
still use irssi in the current state. /bin/ , /usr/bin/ and
/usr/local/bin could be added to unveil I think. My main goal was to
prevent irssi to write scripts and exec them, with the current unveil
from this patch, irssi can't write under ~/.irssi/scripts but can exec
them.


Index: Makefile
===================================================================
RCS file: /data/cvs/ports/net/irssi/Makefile,v
retrieving revision 1.79
diff -u -p -r1.79 Makefile
--- Makefile 18 Feb 2019 18:35:57 -0000 1.79
+++ Makefile 7 Jun 2019 16:53:15 -0000
@@ -5,6 +5,7 @@ COMMENT = modular IRC client with many f
V = 1.2.0
DISTNAME = irssi-$V
PKGSPEC = irssi-=$V
+REVISION = 0

CATEGORIES = net

@@ -15,6 +16,7 @@ MAINTAINER = Klemens Nanni <kn@openbsd.o
# GPLv2+
PERMIT_PACKAGE_CDROM = Yes

+# use pledge()
WANTLIB += c crypto curses gcrypt glib-2.0 gmodule-2.0 gpg-error \
iconv intl m otr pcre perl pthread ssl

@@ -44,6 +46,12 @@ CONFIGURE_ARGS += --with-socks
LIB_DEPENDS += security/dante
WANTLIB += socks
.endif
+
+# required for 100% tests to pass
+PORTHOME= ${WRKDIST}
+
+# required to enable pledge/unveil
+CFLAGS+= -DHAVE_PLEDGE=y

MAKE_FLAGS = scriptdir="${SYSCONFDIR}/irssi/scripts" \
themedir="${SYSCONFDIR}/irssi/themes"
Index: patches/patch-src_core_net-nonblock_c
===================================================================
RCS file: patches/patch-src_core_net-nonblock_c
diff -N patches/patch-src_core_net-nonblock_c
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ patches/patch-src_core_net-nonblock_c 7 Jun 2019 16:38:59 -0000
@@ -0,0 +1,17 @@
+$OpenBSD$
+
+Index: src/core/net-nonblock.c
+--- src/core/net-nonblock.c.orig
++++ src/core/net-nonblock.c
+@@ -60,6 +60,11 @@ int net_gethostbyname_nonblock(const char *addr, GIOCh
+ "Using blocking resolving");
+ }
+
++#ifdef HAVE_PLEDGE
++ if (pledge("dns inet stdio",NULL) == -1)
++ { printf("Error pledge non-block\n"); exit(1); }
++