- This will only work on OpenBSD ≥5.8.
- (As of this note, this has not been officially released: the system will compile with snapshots,
- but the function will not register as enabled during configuration.)
+ This will only work on OpenBSD >5.8.
It is selected with higher priority over systrace(4)
on OpenBSD machines.
diff --git a/sandbox-pledge.c b/sandbox-pledge.c
new file mode 100644
index 00000000..3fcb08e6
--- /dev/null
+++ b/sandbox-pledge.c
@@ -0,0 +1,50 @@
+/* $Id$ */
+/*
+ * Copyright (c) 2015 Kristaps Dzonsons
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#ifdef HAVE_PLEDGE
+
+#include
+
+#include
+
+#include "kcgi.h"
+#include "extern.h"
+
+int
+ksandbox_pledge_init_child(void *arg, enum sandtype type)
+{
+ const char *fl;
+
+ fl = "stdio";
+ if (SAND_CONTROL == type)
+ fl = "stdio unix sendfd recvfd";
+
+ if (-1 == pledge(fl, NULL)) {
+ XWARN("pledge: %s",
+ SAND_CONTROL == type ?
+ "control" : "worker");
+ return(0);
+ }
+ return(1);
+}
+
+#else
+int dummy;
+#endif
diff --git a/test-pledge.c b/test-pledge.c
new file mode 100644
index 00000000..23459f0d
--- /dev/null
+++ b/test-pledge.c
@@ -0,0 +1,13 @@
+#include
+
+#include
+
+int
+main(void)
+{
+ if (-1 == pledge("stdio", NULL)) {
+ perror("pledge");
+ return(1);
+ }
+ return(0);
+}
diff --git a/version_0_7_4.xml b/version_0_7_4.xml
new file mode 100644
index 00000000..ec5c54a6
--- /dev/null
+++ b/version_0_7_4.xml
@@ -0,0 +1,14 @@
+
+
+