Add pledge and unveil
#3823
Merged
Add pledge and unveil
#3823
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
WojciechMazur
requested changes
Mar 9, 2024
|
|
||
| #include <errno.h> | ||
|
|
||
| int pledge(const char *promises, const char *execpromises) { |
There was a problem hiding this comment.
We should not try to redefine it here under the original name, instead let's define it as scalanative_pledge and redirect Scala to it by adding @name("scalanative_pledge") annotation. Same for unveil function
|
After some thinking I'd like to remove C-level placeholder. Let linker fail if user tries to use this function on unsupported OS. This is much better and user friendly behaviour that return undocummented error via errno. I'll update PR shortly |
`pledge` is using to restrict system operations, and `unveil` to unveil parts of a restricted filesystem view. Both of them available at OpenBSD for years. Anyway some work to port it to Linux is onging but it far from the end, and the best status is Justine's work to port it into cosmopolitan libc.
WojciechMazur
approved these changes
Mar 10, 2024
WojciechMazur
approved these changes
Mar 10, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
pledgeis using to restrict system operations, andunveilto unveil parts of a restricted filesystem view.Both of them available at OpenBSD for years. Anyway some work to port it to Linux is onging but it far from the end, and the best status is Justine's work to port it into cosmopolitan libc.