use unveil to restrict which programs could be executed

semarie · Nov 26, 2021 · 5a16728 · 5a16728
1 parent d7f1e90
commit 5a16728
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/sysclean.pl b/sysclean.pl
@@ -132,7 +132,12 @@ sub init
 	my ($self) = @_;
 
 	use OpenBSD::Pledge;
+	use OpenBSD::Unveil;
 
+	unveil('/', 'r');
+	unveil('/usr/bin/locate', 'x');
+	unveil('/usr/sbin/rcctl', 'x');
+
 	pledge('rpath proc exec') || $self->err(1, "pledge");
 	$self->add_expected_base;
 	$self->add_expected_rcctl;