Re: Using unveil(2) to block the entire file system

Hi Chris,

i just committed the patch shown below;
thanks for bringing up the point.

Yours,
Ingo



CVSROOT: /cvs
Module name: src
Changes by: schwarze@cvs.openbsd.org 2019/12/05 17:14:08

Modified files:
lib/libc/sys : unveil.2

Log message:
Explicitly say that *permissions can be "".

Potential for misunderstanding noticed by Chris Rawnsley <chris at
puny dot agency>, wording proposed by deraadt@, patch sent by Chris
Rawnsley, OK deraadt@.


Chris Rawnsley wrote on Wed, Dec 04, 2019 at 06:34:00PM +0000:

> Index: lib/libc/sys/unveil.2
> ===================================================================
> RCS file: /cvs/src/lib/libc/sys/unveil.2,v
> retrieving revision 1.19
> diff -u -p -u -r1.19 unveil.2
> --- lib/libc/sys/unveil.2 25 Jul 2019 13:47:40 -0000 1.19
> +++ lib/libc/sys/unveil.2 4 Dec 2019 18:28:03 -0000
> @@ -62,7 +62,8 @@ promise.
> .Pp
> The
> .Fa permissions
> -argument points to a string consisting of the following characters:
> +argument points to a string consisting of zero or more of the following
> +characters:
> .Pp
> .Bl -tag -width "XXXX" -offset indent -compact
> .It Cm r