pledge_openbsd.go 3.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163
  1. // Copyright 2016 The Go Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style
  3. // license that can be found in the LICENSE file.
  4. package unix
  5. import (
  6. "errors"
  7. "fmt"
  8. "strconv"
  9. "syscall"
  10. "unsafe"
  11. )
  12. // Pledge implements the pledge syscall.
  13. //
  14. // The pledge syscall does not accept execpromises on OpenBSD releases
  15. // before 6.3.
  16. //
  17. // execpromises must be empty when Pledge is called on OpenBSD
  18. // releases predating 6.3, otherwise an error will be returned.
  19. //
  20. // For more information see pledge(2).
  21. func Pledge(promises, execpromises string) error {
  22. maj, min, err := majmin()
  23. if err != nil {
  24. return err
  25. }
  26. err = pledgeAvailable(maj, min, execpromises)
  27. if err != nil {
  28. return err
  29. }
  30. pptr, err := syscall.BytePtrFromString(promises)
  31. if err != nil {
  32. return err
  33. }
  34. // This variable will hold either a nil unsafe.Pointer or
  35. // an unsafe.Pointer to a string (execpromises).
  36. var expr unsafe.Pointer
  37. // If we're running on OpenBSD > 6.2, pass execpromises to the syscall.
  38. if maj > 6 || (maj == 6 && min > 2) {
  39. exptr, err := syscall.BytePtrFromString(execpromises)
  40. if err != nil {
  41. return err
  42. }
  43. expr = unsafe.Pointer(exptr)
  44. }
  45. _, _, e := syscall.Syscall(SYS_PLEDGE, uintptr(unsafe.Pointer(pptr)), uintptr(expr), 0)
  46. if e != 0 {
  47. return e
  48. }
  49. return nil
  50. }
  51. // PledgePromises implements the pledge syscall.
  52. //
  53. // This changes the promises and leaves the execpromises untouched.
  54. //
  55. // For more information see pledge(2).
  56. func PledgePromises(promises string) error {
  57. maj, min, err := majmin()
  58. if err != nil {
  59. return err
  60. }
  61. err = pledgeAvailable(maj, min, "")
  62. if err != nil {
  63. return err
  64. }
  65. // This variable holds the execpromises and is always nil.
  66. var expr unsafe.Pointer
  67. pptr, err := syscall.BytePtrFromString(promises)
  68. if err != nil {
  69. return err
  70. }
  71. _, _, e := syscall.Syscall(SYS_PLEDGE, uintptr(unsafe.Pointer(pptr)), uintptr(expr), 0)
  72. if e != 0 {
  73. return e
  74. }
  75. return nil
  76. }
  77. // PledgeExecpromises implements the pledge syscall.
  78. //
  79. // This changes the execpromises and leaves the promises untouched.
  80. //
  81. // For more information see pledge(2).
  82. func PledgeExecpromises(execpromises string) error {
  83. maj, min, err := majmin()
  84. if err != nil {
  85. return err
  86. }
  87. err = pledgeAvailable(maj, min, execpromises)
  88. if err != nil {
  89. return err
  90. }
  91. // This variable holds the promises and is always nil.
  92. var pptr unsafe.Pointer
  93. exptr, err := syscall.BytePtrFromString(execpromises)
  94. if err != nil {
  95. return err
  96. }
  97. _, _, e := syscall.Syscall(SYS_PLEDGE, uintptr(pptr), uintptr(unsafe.Pointer(exptr)), 0)
  98. if e != 0 {
  99. return e
  100. }
  101. return nil
  102. }
  103. // majmin returns major and minor version number for an OpenBSD system.
  104. func majmin() (major int, minor int, err error) {
  105. var v Utsname
  106. err = Uname(&v)
  107. if err != nil {
  108. return
  109. }
  110. major, err = strconv.Atoi(string(v.Release[0]))
  111. if err != nil {
  112. err = errors.New("cannot parse major version number returned by uname")
  113. return
  114. }
  115. minor, err = strconv.Atoi(string(v.Release[2]))
  116. if err != nil {
  117. err = errors.New("cannot parse minor version number returned by uname")
  118. return
  119. }
  120. return
  121. }
  122. // pledgeAvailable checks for availability of the pledge(2) syscall
  123. // based on the running OpenBSD version.
  124. func pledgeAvailable(maj, min int, execpromises string) error {
  125. // If OpenBSD <= 5.9, pledge is not available.
  126. if (maj == 5 && min != 9) || maj < 5 {
  127. return fmt.Errorf("pledge syscall is not available on OpenBSD %d.%d", maj, min)
  128. }
  129. // If OpenBSD <= 6.2 and execpromises is not empty,
  130. // return an error - execpromises is not available before 6.3
  131. if (maj < 6 || (maj == 6 && min <= 2)) && execpromises != "" {
  132. return fmt.Errorf("cannot use execpromises on OpenBSD %d.%d", maj, min)
  133. }
  134. return nil
  135. }