Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Support of OpenBSD pledge(2) and unveil(2) in programming languages

Support of OpenBSD's pledge(2) and unveil(2) in programming languages

Right now pledge(2) and unveil(2) is available on OpenBSD only, but there was attempt to port them to Linux.

Language Support of unveil(2) Support of pledge(2)
C/C++ Yes Yes
Crystal No Yes
Erlang Yes Yes
Go Yes Yes
Haskell No Yes
Korn Shell Yes Yes
Lua No Yes
Nim No Yes
.NET (C#, F# and VB) No Yes
Perl Yes: 1, (mirror) Yes: 1 (mirror), 2
PHP Yes (included in PHP 7.4) Yes (included in PHP 7.4)
Python Yes (py-openbsd) Yes (py-openbsd-pledge, py-pledge)
Rust Yes Yes
Ruby Yes Yes
Scheme No Yes
Javascript Yes Yes: 1, 2
Java No Yes
@n0la

This comment has been minimized.

Copy link

commented Apr 7, 2016

I also have a port for lua-openbsd here: luaports.

@NattyNarwhal

This comment has been minimized.

Copy link

commented Apr 8, 2016

here's my C# version: (which can be used with any .NET language - F# and VB included) pledge.cs

@ligurio

This comment has been minimized.

Copy link
Owner Author

commented Apr 8, 2016

@NattyNarwhal, thanks!

@msantos

This comment has been minimized.

Copy link

commented Apr 9, 2016

And support for Erlang/Elixir/lfe! https://github.com/msantos/prx/wiki/prx#pledge-3

@absorber

This comment has been minimized.

Copy link

commented Apr 10, 2016

Would be great if we would have something like this for Bash too.

@evhan

This comment has been minimized.

Copy link

commented Apr 10, 2016

@netzbasis

This comment has been minimized.

Copy link

commented Apr 10, 2016

@absorber, not Bash but ksh: netzbasis/openbsd-src@master...hf-ksh_builtin_pledge
Just for testing...

@ligurio

This comment has been minimized.

Copy link
Owner Author

commented Apr 11, 2016

@evhan, added. Thanks!

@euantorano

This comment has been minimized.

@ligurio

This comment has been minimized.

Copy link
Owner Author

commented Apr 13, 2016

@euantorano, added. Thanks!

@tvlooy

This comment has been minimized.

Copy link

commented Nov 5, 2016

Pledge and unveil for PHP https://github.com/tvlooy/php-pledge

@ligurio

This comment has been minimized.

Copy link
Owner Author

commented Nov 9, 2016

@tvlooy, added, thanks! :)

@tvlooy

This comment has been minimized.

Copy link

commented Apr 10, 2019

Note that with PHP 7.4 you have FFI available and can call C functions without needing an extension:

$libc = FFI::cdef('
    int unveil(const char *path, const char *permissions);
', 'libc.so.92.5');

$libc->unveil(__DIR__, 'r');
@ligurio

This comment has been minimized.

Copy link
Owner Author

commented Apr 29, 2019

@tvlooy, updated, thanks!

@eau-u4f

This comment has been minimized.

Copy link

commented Apr 30, 2019

hello, unveil(2) is present for some in the x/sys, same place as pledge for the build of golang on openbsd, they recently updated the build tags and moved it to master: https://github.com/golang/sys/blob/master/unix/unveil_openbsd.go, same goes for pledge: https://github.com/golang/sys/blob/master/unix/pledge_openbsd.go, so i'd say "yes" / "yes" for both? hth

@tvlooy

This comment has been minimized.

Copy link

commented Apr 30, 2019

actually with PHP 7.4 you can use pledge too. It's the same mechanism (FFI)

@ligurio

This comment has been minimized.

Copy link
Owner Author

commented May 2, 2019

@eau-u4f, updated, thanks!
@tvlooy, added, thanks!

@netzbasis

This comment has been minimized.

Copy link

commented May 4, 2019

ksh has a early version of unveil, too. Same branch as pledge.

@ligurio

This comment has been minimized.

Copy link
Owner Author

commented May 6, 2019

@netzbasis, thanks, added. (looks like you have accidentally committed coredump file (echo.core))

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.