|
1 |
| -## A wrapper for the `pledge(2) <http://man.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/pledge.2?query=pledge>`_ systemcall, used to restrict system operations. |
2 |
| -## |
3 |
| -## On systems other than OpenBSD where `pledge` is not yet implemented, the wrapper has no effect. |
4 |
| -## |
5 |
| -## Example of making a single promise |
6 |
| -## ---------------------------------- |
7 |
| -## |
8 |
| -## In order to pledge to only use the `stdio` promise as described in the `pledge(2) man page <http://man.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/pledge.2?query=pledge>`_, you simply pass the `Promise.Stdio` to `pledge()`: |
9 |
| -## |
10 |
| -## .. code-block::nim |
11 |
| -## import pledge |
12 |
| -## |
13 |
| -## let pledged = pledge(Promises.Stdio) |
14 |
| -## |
15 |
| -## Example of making several promises |
16 |
| -## ---------------------------------- |
17 |
| -## |
18 |
| -## In order to pledge to use the `stdio` and `rpath` promises as described in the `pledge(2) man page <http://man.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/pledge.2?query=pledge>`_, you simply pass the required promises to `pledge()`: |
19 |
| -## |
20 |
| -## .. code-block::nim |
21 |
| -## import pledge |
22 |
| -## |
23 |
| -## let pledged = pledge(Promises.Stdio, Promises.Rpath) |
24 |
| - |
25 |
| -from os import osLastError, raiseOSError |
26 |
| -from sequtils import map, deduplicate |
27 |
| -from strutils import join |
28 |
| - |
29 |
| -type Promise* {.pure.} = enum |
30 |
| - ## The possible operation sets that a program can pledge to be limited to. |
31 |
| - Stdio = "stdio", |
32 |
| - Rpath = "rpath", |
33 |
| - Wpath = "wpath", |
34 |
| - Cpath = "cpath", |
35 |
| - Dpath = "dpath", |
36 |
| - Tmppath = "tmppath", |
37 |
| - Inet = "inet", |
38 |
| - Fattr = "fattr", |
39 |
| - Flock = "flock", |
40 |
| - Unix = "unix", |
41 |
| - Dns = "dns", |
42 |
| - Getpw = "getpw", |
43 |
| - Sendfd = "sendfd", |
44 |
| - Recvfd = "recvfd", |
45 |
| - Ioctl = "ioctl", |
46 |
| - Tty = "tty", |
47 |
| - Proc = "proc", |
48 |
| - Exec = "exec", |
49 |
| - Prot_exec = "prot_exec", |
50 |
| - Settime = "settime", |
51 |
| - Ps = "ps", |
52 |
| - Vminfo = "vminfo", |
53 |
| - Id = "id", |
54 |
| - Pf = "pf", |
55 |
| - Audio = "audio" |
56 |
| - |
57 |
| -when defined(nimdoc): |
58 |
| - proc pledge*(promises: varargs[Promise]): bool {.raises: [OSError].} = discard |
59 |
| - ## Pledge to use only the defined functions. Always returns true on non-OpenBSD systems. |
60 |
| - ## |
61 |
| - ## If the pledge call was successful, this will return true. |
62 |
| - ## |
63 |
| - ## If the pledge call is not successful, an `OSError` will be thrown. |
64 |
| -elif defined(openbsd): |
65 |
| - proc pledge_c(promises: cstring, paths: cstringArray): cint {.importc: "pledge".} |
66 |
| - |
67 |
| - proc promisesToString(promises: openArray[Promise]): string = |
68 |
| - ## Convert a list of promises to a string for use with the `pledge(2)` function. |
69 |
| - let stringPromises = map(promises, proc(p: Promise): string = $p) |
70 |
| - return join(deduplicate(stringPromises), " ") |
71 |
| - |
72 |
| - proc pledge*(promises: varargs[Promise]): bool {.raises: [OSError].} = |
73 |
| - let promisesString = promisesToString(promises) |
74 |
| - let pledged = pledge_c(promisesString, nil) |
75 |
| - |
76 |
| - if pledged != 0: |
77 |
| - let errorCode = osLastError() |
78 |
| - raiseOSError(errorCode) |
79 |
| - |
80 |
| - result = true |
81 |
| - |
82 |
| -else: |
83 |
| - proc pledge*(promises: varargs[Promise]): bool = true |
| 1 | +## A wrapper for the `pledge(2) <http://man.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/pledge.2?query=pledge>`_ systemcall, used to restrict system operations. |
| 2 | +## |
| 3 | +## On systems other than OpenBSD where `pledge` is not yet implemented, the wrapper has no effect. |
| 4 | +## |
| 5 | +## Example of making a single promise |
| 6 | +## ---------------------------------- |
| 7 | +## |
| 8 | +## In order to pledge to only use the `stdio` promise as described in the `pledge(2) man page <http://man.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/pledge.2?query=pledge>`_, you simply pass the `Promise.Stdio` to `pledge()`: |
| 9 | +## |
| 10 | +## .. code-block::nim |
| 11 | +## import pledge |
| 12 | +## |
| 13 | +## let pledged = pledge(Promise.Stdio) |
| 14 | +## |
| 15 | +## Example of making several promises |
| 16 | +## ---------------------------------- |
| 17 | +## |
| 18 | +## In order to pledge to use the `stdio` and `rpath` promises as described in the `pledge(2) man page <http://man.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/pledge.2?query=pledge>`_, you simply pass the required promises to `pledge()`: |
| 19 | +## |
| 20 | +## .. code-block::nim |
| 21 | +## import pledge |
| 22 | +## |
| 23 | +## let pledged = pledge(Promise.Stdio, Promise.Rpath) |
| 24 | + |
| 25 | +from os import osLastError, raiseOSError |
| 26 | +from sequtils import map, deduplicate |
| 27 | +from strutils import join |
| 28 | + |
| 29 | +type Promise* {.pure.} = enum |
| 30 | + ## The possible operation sets that a program can pledge to be limited to. |
| 31 | + Stdio = "stdio", |
| 32 | + Rpath = "rpath", |
| 33 | + Wpath = "wpath", |
| 34 | + Cpath = "cpath", |
| 35 | + Dpath = "dpath", |
| 36 | + Tmppath = "tmppath", |
| 37 | + Inet = "inet", |
| 38 | + Fattr = "fattr", |
| 39 | + Flock = "flock", |
| 40 | + Unix = "unix", |
| 41 | + Dns = "dns", |
| 42 | + Getpw = "getpw", |
| 43 | + Sendfd = "sendfd", |
| 44 | + Recvfd = "recvfd", |
| 45 | + Ioctl = "ioctl", |
| 46 | + Tty = "tty", |
| 47 | + Proc = "proc", |
| 48 | + Exec = "exec", |
| 49 | + Prot_exec = "prot_exec", |
| 50 | + Settime = "settime", |
| 51 | + Ps = "ps", |
| 52 | + Vminfo = "vminfo", |
| 53 | + Id = "id", |
| 54 | + Pf = "pf", |
| 55 | + Audio = "audio" |
| 56 | + |
| 57 | +when defined(nimdoc): |
| 58 | + proc pledge*(promises: varargs[Promise]): bool {.raises: [OSError].} = discard |
| 59 | + ## Pledge to use only the defined functions. Always returns true on non-OpenBSD systems. |
| 60 | + ## |
| 61 | + ## If the pledge call was successful, this will return true. |
| 62 | + ## |
| 63 | + ## If the pledge call is not successful, an `OSError` will be thrown. |
| 64 | +elif defined(openbsd): |
| 65 | + proc pledge_c(promises: cstring, paths: cstringArray): cint {.importc: "pledge".} |
| 66 | + |
| 67 | + proc promisesToString(promises: openArray[Promise]): string = |
| 68 | + ## Convert a list of promises to a string for use with the `pledge(2)` function. |
| 69 | + let stringPromises = map(promises, proc(p: Promise): string = $p) |
| 70 | + return join(deduplicate(stringPromises), " ") |
| 71 | + |
| 72 | + proc pledge*(promises: varargs[Promise]): bool {.raises: [OSError].} = |
| 73 | + let promisesString = promisesToString(promises) |
| 74 | + let pledged = pledge_c(promisesString, nil) |
| 75 | + |
| 76 | + if pledged != 0: |
| 77 | + let errorCode = osLastError() |
| 78 | + raiseOSError(errorCode) |
| 79 | + |
| 80 | + result = true |
| 81 | + |
| 82 | +else: |
| 83 | + proc pledge*(promises: varargs[Promise]): bool = true |
0 commit comments