bsdcontrol.rb 0.2.1 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0bcd52d19202a55fc6176b596436dba3ec085b6ad1306061a542025f0734f23c
-  data.tar.gz: bc8d18ded3d2be28dd13ebd894a3d427ea2fc8c7e6cd3318a3c2af1a2e7206a3
+  metadata.gz: b226b4654ead9d86f8658f1f2578b589bde0647c87ed6bdd2393afa8a70b3a14
+  data.tar.gz: 7fe0f050a4c3168456785f51cbea8f033aa01ff822bc70efbacd7f237478b674
 SHA512:
-  metadata.gz: da3aee74d3443f889cf5b6458054f0b1ae6000597f0a639105852d37806586ab8753bb1c8f87ba102cdfdcf59c26559ffa62cbbf20df969087732c7307c4b619
-  data.tar.gz: 38ac41550d6d9b8ab8873fd6bd846648e929e7d4c078cc5b9a7152c3ae8611bbfffaf23d0e965cb54d783e333e86ba86003ae9b4c59638dcd56e9077c5f6ebee
+  metadata.gz: ea15d78c722aee649f614248364d28aed968572590cfab91be2995a8607d75df534ccf0af459973d1174a81841753e68c851b8f6a2eab5c4d1fc3dba9f0a5917
+  data.tar.gz: 32141573f2ce20eb1be88267fa5f657017522f31cff6e7610c080ddbbd84fe10325e925d266e1b3e21da9e83d7e3c77f338b74adb804b4f1c9ae9fd0e5ec769c

data/README.md

@@ -1,13 +1,15 @@
 ## About
 
-bsdcontrol.rb provides Ruby bindings for libhbsdcontrol from the
-[HardenedBSD](https://HardenedBSD.org) project.
+bsdcontrol.rb provides Ruby bindings for
+[libhbsdcontrol](https://git.hardenedbsd.org/hardenedbsd/HardenedBSD/-/tree/hardened/current/master/lib/libhbsdcontrol/).
 
 ## Examples
 
-__Features__
+### BSD::Control
 
-The first example prints a list of HardenedBSD features that
+#### Features
+
+The following example prints a list of HardenedBSD features that
 can be enabled, disabled or restored to the system default
 setting:
 
@@ -22,9 +24,9 @@ BSD::Control
 end
 ```
 
-__Enable__
+#### Enable
 
-The following example enables the mprotect feature for the emacs binary. When
+The next example enables the mprotect feature for the emacs binary. When
 a feature is enabled for a given file, that setting takes precendence
 over the system default. The system default can be restored with
 [BSD::Control::Feature#sysdef!](http://0x1eef.github.io/x/bsdcontrol.rb/BSD/Control/Feature.html#sysdef!-instance_method):
@@ -35,10 +37,10 @@ over the system default. The system default can be restored with
 require "bsdcontrol"
 BSD::Control
   .feature(:mprotect)
-  .enable!("/usr/local/bin/emacs-29.2")
+  .enable! File.realpath("/usr/local/bin/emacs")
 ```
 
-__Status__
+#### Status
 
 There are five recognized statuses: `unknown`, `enabled`, `disabled`,
 `sysdef`, and `invalid`. The `sysdef` status indicates that a feature
@@ -54,15 +56,34 @@ BSD::Control
   .status("/bin/ls") # => :sysdef
 ```
 
+#### Namespaces
+
+The libhbsdcontrol library is implemented via extended attribute namespaces
+(see [extattr(2)](https://man.freebsd.org/extattr)), and the default namespace
+is the "system" namespace. The "system" namespace requires root privileges if
+you want to modify or read attributes, but the "user" namespace can be accessed by
+unprivileged users.
+
+At the moment the HardenedBSD kernel works purely with the system namespace, but
+there are plans to add support for the user namespace in the future. Switching between
+namespaces can be achieved with the [BSD::Control::Feature#set_namespace](http://0x1eef.github.io/x/bsdcontrol.rb/BSD/Control/Feature.html#namespace=-instance_method)
+method:
+
+``` ruby
+#!/usr/bin/env ruby
+# Required privileges: user
+require "bsdcontrol"
+BSD::Control.set_namespace(:user)
+BSD::Control["mprotect"].status("/bin/ls") # => :sysdef
+```
+
 ## Documentation
 
 A complete API reference is available at
-[0x1eef.github.io/x/bsdcontrol.rb](https://0x1eef.github.io/x/bsdcontrol.rb).
+[0x1eef.github.io/x/bsdcontrol.rb](https://0x1eef.github.io/x/bsdcontrol.rb)
 
 ## Install
 
-**Rubygems.org**
-
 bsdcontrol.rb can be installed via rubygems.org:
 
     gem install bsdcontrol.rb
@@ -71,11 +92,11 @@ bsdcontrol.rb can be installed via rubygems.org:
 
 * [GitHub](https://github.com/0x1eef/bsdcontrol.rb)
 * [GitLab](https://gitlab.com/0x1eef/bsdcontrol.rb)
-* [git.HardenedBSD.org](https://git.HardenedBSD.org/0x1eef/bsdcontrol.rb)
+* [git.HardenedBSD.org/@0x1eef](https://git.HardenedBSD.org/0x1eef/bsdcontrol.rb)
+* [brew.bsd.cafe/@0x1eef](https://brew.bsd.cafe/0x1eef/bsdcontrol.rb)
 
 ## License
 
-[BSD Zero Clause](https://choosealicense.com/licenses/0bsd/).
+[BSD Zero Clause](https://choosealicense.com/licenses/0bsd/)
 <br>
-See [LICENSE](./LICENSE).
-
+See [LICENSE](./LICENSE)

data/ext/bsdcontrol.rb/bsdcontrol.c

@@ -1,6 +1,11 @@
 #include <ruby.h>
+#include <libhbsdcontrol.h>
+#include <fcntl.h>
+#include <errno.h>
+
 #include "context.h"
 #include "feature.h"
+#include "bsdcontrol.h"
 
 void
 Init_bsdcontrol(void)
@@ -12,6 +17,10 @@ Init_bsdcontrol(void)
     rb_define_alloc_func(rb_cContext, bsdcontrol_context_alloc);
     rb_define_method(
         rb_cContext, "library_version", bsdcontrol_context_library_version, 0);
+    rb_define_method(
+        rb_cContext, "set_namespace", bsdcontrol_context_set_namespace, 1);
+    rb_define_method(
+        rb_cContext, "namespace", bsdcontrol_context_get_namespace, 0);
     rb_define_method(rb_cContext,
                      "available_features",
                      bsdcontrol_context_available_features,
@@ -22,3 +31,16 @@ Init_bsdcontrol(void)
     rb_define_const(rb_cFeature, "ENABLED", INT2NUM(HBSDCTRL_STATE_ENABLED));
     rb_define_const(rb_cFeature, "DISABLED", INT2NUM(HBSDCTRL_STATE_DISABLED));
 }
+
+int
+bsdcontrol_open(VALUE path)
+{
+    int fd;
+    Check_Type(path, T_STRING);
+    fd = open(RSTRING_PTR(path), O_PATH);
+    if (fd == -1)
+    {
+        rb_syserr_fail(errno, "open");
+    }
+    return fd;
+}

data/ext/bsdcontrol.rb/bsdcontrol.h

@@ -0,0 +1,5 @@
+#pragma once
+#include <ruby.h>
+#include <libhbsdcontrol.h>
+
+int bsdcontrol_open(VALUE);

data/ext/bsdcontrol.rb/context.c

@@ -1,7 +1,9 @@
 #include <ruby.h>
 #include <libhbsdcontrol.h>
+#include <sys/extattr.h>
+#include <libutil.h>
 #include "context.h"
-#include "glue.h"
+#include "bsdcontrol.h"
 
 static int FLAGS             = HBSDCTRL_FEATURE_STATE_FLAG_NONE;
 static const char *NAMESPACE = LIBHBSDCONTROL_DEFAULT_NAMESPACE;
@@ -39,7 +41,7 @@ bsdcontrol_context_available_features(VALUE self)
           feature = 0, features = rb_ary_new();
     hbsdctrl_ctx_t *ctx;
     char **name;
-    ctx  = bsdcontrol_unwrap(self);
+    ctx  = bsdcontrol_context_unwrap(self);
     name = hbsdctrl_ctx_all_feature_names(ctx);
     while (*name != NULL)
     {
@@ -59,6 +61,63 @@ VALUE
 bsdcontrol_context_library_version(VALUE self)
 {
     hbsdctrl_ctx_t *ctx;
-    ctx = bsdcontrol_unwrap(self);
+    ctx = bsdcontrol_context_unwrap(self);
     return ULONG2NUM(ctx->hc_version);
 }
+
+/*
+ * BSD::Control::Context#namespace
+ * BSD::Control.namespace
+ */
+VALUE
+bsdcontrol_context_get_namespace(VALUE self)
+{
+    hbsdctrl_ctx_t *ctx;
+    char *namespace;
+    ctx = bsdcontrol_context_unwrap(self);
+    if (extattr_namespace_to_string(ctx->hc_namespace, &namespace) == 0)
+    {
+        return ID2SYM(rb_intern(namespace));
+    }
+    else
+    {
+        return Qnil;
+    }
+}
+
+/*
+ * BSD::Control::Context#set_namespace
+ * BSD::Control.set_namespace
+ */
+VALUE
+bsdcontrol_context_set_namespace(VALUE self, VALUE namespace)
+{
+    Check_Type(namespace, T_STRING);
+    hbsdctrl_ctx_t *ctx;
+    char *ns;
+    ns = RSTRING_PTR(namespace);
+    if (strcmp(ns, "system") == 0 || strcmp(ns, "user") == 0)
+    {
+        ctx = bsdcontrol_context_unwrap(self);
+        if (extattr_string_to_namespace(ns, &(ctx->hc_namespace)) == 0)
+        {
+            return Qtrue;
+        }
+        else
+        {
+            return Qfalse;
+        }
+    }
+    else
+    {
+        rb_raise(rb_eArgError, "namespace must be 'system' or 'user'");
+    }
+}
+
+hbsdctrl_ctx_t *
+bsdcontrol_context_unwrap(VALUE rbcontext)
+{
+    hbsdctrl_ctx_t *ctx;
+    Data_Get_Struct(rbcontext, hbsdctrl_ctx_t, ctx);
+    return ctx;
+}

data/ext/bsdcontrol.rb/context.h

@@ -4,3 +4,6 @@
 VALUE bsdcontrol_context_alloc(VALUE);
 VALUE bsdcontrol_context_library_version(VALUE);
 VALUE bsdcontrol_context_available_features(VALUE);
+VALUE bsdcontrol_context_set_namespace(VALUE, VALUE);
+VALUE bsdcontrol_context_get_namespace(VALUE);
+hbsdctrl_ctx_t* bsdcontrol_context_unwrap(VALUE);

data/ext/bsdcontrol.rb/feature.c

@@ -4,7 +4,7 @@
 #include <errno.h>
 #include "feature.h"
 #include "context.h"
-#include "glue.h"
+#include "bsdcontrol.h"
 
 /*
  * BSD::Control::Feature#status
@@ -19,8 +19,8 @@ bsdcontrol_feature_status(VALUE self, VALUE path)
     hbsdctrl_ctx_t *ctx;
     rbcontext = rb_funcall(self, rb_intern("context"), 0);
     fd        = bsdcontrol_open(path);
-    ctx       = bsdcontrol_unwrap(rbcontext);
-    feature   = bsdcontrol_find_feature(ctx, self);
+    ctx       = bsdcontrol_context_unwrap(rbcontext);
+    feature   = bsdcontrol_feature_find_by_name(ctx, self);
     errno     = 0;
     if (feature->hf_get(ctx, feature, &fd, &state) == RES_FAIL)
     {
@@ -50,8 +50,8 @@ bsdcontrol_feature_set(VALUE self, VALUE path, VALUE rbstate)
     int state;
     rbcontext = rb_funcall(self, rb_intern("context"), 0);
     fd        = bsdcontrol_open(path);
-    ctx       = bsdcontrol_unwrap(rbcontext);
-    feature   = bsdcontrol_find_feature(ctx, self);
+    ctx       = bsdcontrol_context_unwrap(rbcontext);
+    feature   = bsdcontrol_feature_find_by_name(ctx, self);
     state     = NUM2INT(rbstate);
     errno     = 0;
     if (feature->hf_apply(ctx, feature, &fd, &state) == RES_FAIL)
@@ -79,8 +79,8 @@ bsdcontrol_feature_sysdef(VALUE self, VALUE path)
     hbsdctrl_ctx_t *ctx;
     rbcontext = rb_funcall(self, rb_intern("context"), 0);
     fd        = bsdcontrol_open(path);
-    ctx       = bsdcontrol_unwrap(rbcontext);
-    feature   = bsdcontrol_find_feature(ctx, self);
+    ctx       = bsdcontrol_context_unwrap(rbcontext);
+    feature   = bsdcontrol_feature_find_by_name(ctx, self);
     errno     = 0;
     if (feature->hf_unapply(ctx, feature, &fd, NULL) == RES_FAIL)
     {
@@ -94,3 +94,12 @@ bsdcontrol_feature_sysdef(VALUE self, VALUE path)
         return Qtrue;
     }
 }
+
+hbsdctrl_feature_t *
+bsdcontrol_feature_find_by_name(hbsdctrl_ctx_t *ctx, VALUE rbfeature)
+{
+    VALUE name;
+    name = rb_funcall(rbfeature, rb_intern("name"), 0);
+    Check_Type(name, T_STRING);
+    return hbsdctrl_ctx_find_feature_by_name(ctx, RSTRING_PTR(name));
+}

data/ext/bsdcontrol.rb/feature.h

@@ -1,4 +1,9 @@
+#pragma once
+
 #include <ruby.h>
+#include <libhbsdcontrol.h>
+
 VALUE bsdcontrol_feature_status(VALUE, VALUE);
 VALUE bsdcontrol_feature_set(VALUE,VALUE,VALUE);
 VALUE bsdcontrol_feature_sysdef(VALUE, VALUE);
+hbsdctrl_feature_t* bsdcontrol_feature_find_by_name(hbsdctrl_ctx_t*, VALUE);

data/lib/bsd/control/feature.rb

@@ -14,13 +14,10 @@ module BSD::Control
 
     ##
     # Enables a feature for a given file
-    #
     # @param [String] path
     #  The path to a file
-    #
     # @raise [SystemCallError]
     #  Might raise a number of Errno exceptions
-    #
     # @return [Boolean]
     #  Returns true on success
     def enable!(path)
@@ -29,13 +26,10 @@ module BSD::Control
 
     ##
     # Disables a feature for a given file
-    #
     # @param [String] path
     #  The path to a file
-    #
     # @raise [SystemCallError]
     #  Might raise a number of Errno exceptions
-    #
     # @return [Boolean]
     #  Returns true on success
     def disable!(path)
@@ -45,13 +39,10 @@ module BSD::Control
     ##
     # @!method sysdef!(path)
     #   Restores the system default for a given file
-    #
     #   @param [String] path
     #     The path to a file
-    #
     #   @raise [SystemCallError]
     #     Might raise a number of Errno exceptions
-    #
     #   @return [Boolean]
     #     Returns true on success
 
@@ -63,7 +54,6 @@ module BSD::Control
     ##
     # @param [String] path
     #  The path to a file
-    #
     # @return [Boolean]
     #  Returns true when a feature is enabled
     def enabled?(path)
@@ -73,7 +63,6 @@ module BSD::Control
     ##
     # @param [String] path
     #  The path to a file.
-    #
     # @return [Boolean]
     #  Returns true when a feature is disabled
     def disabled?(path)
@@ -83,7 +72,6 @@ module BSD::Control
     ##
     # @param [String] path
     #  The path to a file
-    #
     # @return [Boolean]
     #  Returns true when the system default setting is used
     def sysdef?(path)
@@ -93,7 +81,6 @@ module BSD::Control
     ##
     # @param [String] path
     #  The path to a file
-    #
     # @return [Boolean]
     #  Returns true when a feature is in an invalid state
     #  (eg: the feature is both enabled and disabled at the same time)
@@ -105,10 +92,8 @@ module BSD::Control
     # @!method status(path)
     #   @param [String] path
     #     The path to a file
-    #
     #   @raise [SystemCallError]
     #     Might raise a number of Errno exceptions
-    #
     #   @return [Symbol]
     #     Returns the status of a feature for a given file.
     #     Status could be: `:unknown`, `:enabled`, `:disabled`,

data/lib/bsd/control/version.rb

@@ -2,6 +2,6 @@
 
 module BSD
   module Control
-    VERSION = "0.2.1"
+    VERSION = "0.3.0"
   end
 end

data/lib/bsd/control.rb

@@ -20,6 +20,23 @@ module BSD::Control
     context.library_version
   end
 
+  ##
+  # @param [#to_s] namespace
+  #  Either "user" or "system"
+  # @raise [ArgumentError]
+  #  When an invalid namespace was given
+  # @return [void]
+  def self.set_namespace(namespace)
+    context.set_namespace(namespace.to_s)
+  end
+
+  ##
+  # @return [String]
+  #  Returns the current namespace
+  def self.namespace
+    context.namespace
+  end
+
   ##
   # @return [Array<BSD::Control::Feature>]
   #  Returns an array of available features
@@ -29,16 +46,16 @@ module BSD::Control
 
   ##
   # @example
+  #   # This works
   #   BSD::Control
   #     .feature(:mprotect)
   #     .enable!("/usr/local/bin/emacs-29.2")
-  #
+  #   # This also works
+  #   BSD::Control[:mprotect].enable!("/usr/local/bin/emacs-29.2")
   # @param [String] name
   #  The name of a feature
-  #
   # @raise [BSD::Control::Error]
   #  When a feature wasn't found
-  #
   # @return [BSD::Control::Feature]
   #  Returns an instance of {BSD::Control::Feature BSD::Control::Feature}
   def self.feature(name)
@@ -46,6 +63,10 @@ module BSD::Control
     feature || raise(Error, "'#{name}' wasn't found")
   end
 
+  class << self
+    alias_method :[], :feature
+  end
+
   require_relative "control/context"
   require_relative "control/feature"
   require_relative "../bsdcontrol.rb.so"

data/share/bsdcontrol.rb/examples/2_feature_enable.rb

@@ -0,0 +1,8 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# Required privileges: superuser
+require "bsdcontrol"
+BSD::Control
+  .feature(:mprotect)
+  .enable! File.realpath("/usr/local/bin/emacs")

data/share/bsdcontrol.rb/examples/3_feature_status.rb

@@ -0,0 +1,8 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# Required privileges: superuser
+require "bsdcontrol"
+BSD::Control
+  .feature(:mprotect)
+  .status("/bin/ls") # => :sysdef

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bsdcontrol.rb
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.3.0
 platform: ruby
 authors:
 - '0x1eef'
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-05-14 00:00:00.000000000 Z
+date: 2025-03-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake-compiler
@@ -44,14 +44,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.8'
+        version: '0.12'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.8'
+        version: '0.12'
 - !ruby/object:Gem::Dependency
   name: test-unit
   requirement: !ruby/object:Gem::Requirement
@@ -66,6 +66,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '3.6'
+- !ruby/object:Gem::Dependency
+  name: irb
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.15'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.15'
 description: Ruby bindings for libhbsdcontrol
 email:
 - 0x1eef@protonmail.com
@@ -75,19 +89,20 @@ extensions:
 extra_rdoc_files: []
 files:
 - "./ext/bsdcontrol.rb/bsdcontrol.c"
+- "./ext/bsdcontrol.rb/bsdcontrol.h"
 - "./ext/bsdcontrol.rb/context.c"
 - "./ext/bsdcontrol.rb/context.h"
 - "./ext/bsdcontrol.rb/extconf.rb"
 - "./ext/bsdcontrol.rb/feature.c"
 - "./ext/bsdcontrol.rb/feature.h"
-- "./ext/bsdcontrol.rb/glue.c"
-- "./ext/bsdcontrol.rb/glue.h"
 - "./lib/bsd/control.rb"
 - "./lib/bsd/control/context.rb"
 - "./lib/bsd/control/feature.rb"
 - "./lib/bsd/control/version.rb"
 - "./lib/bsdcontrol.rb"
 - "./share/bsdcontrol.rb/examples/1_available_features.rb"
+- "./share/bsdcontrol.rb/examples/2_feature_enable.rb"
+- "./share/bsdcontrol.rb/examples/3_feature_status.rb"
 - LICENSE
 - README.md
 - ext/bsdcontrol.rb/extconf.rb
@@ -110,7 +125,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.9
+rubygems_version: 3.5.23
 signing_key:
 specification_version: 4
 summary: Ruby bindings for libhbsdcontrol

data/ext/bsdcontrol.rb/glue.c

@@ -1,36 +0,0 @@
-#include <ruby.h>
-#include <libhbsdcontrol.h>
-#include <fcntl.h>
-#include <errno.h>
-#include "glue.h"
-#include "context.h"
-
-int
-bsdcontrol_open(VALUE path)
-{
-    int fd;
-    Check_Type(path, T_STRING);
-    fd = open(RSTRING_PTR(path), O_PATH);
-    if (fd == -1)
-    {
-        rb_syserr_fail(errno, "open");
-    }
-    return fd;
-}
-
-hbsdctrl_ctx_t *
-bsdcontrol_unwrap(VALUE rbcontext)
-{
-    hbsdctrl_ctx_t *ctx;
-    Data_Get_Struct(rbcontext, hbsdctrl_ctx_t, ctx);
-    return ctx;
-}
-
-hbsdctrl_feature_t *
-bsdcontrol_find_feature(hbsdctrl_ctx_t *ctx, VALUE rbfeature)
-{
-    VALUE name;
-    name = rb_funcall(rbfeature, rb_intern("name"), 0);
-    Check_Type(name, T_STRING);
-    return hbsdctrl_ctx_find_feature_by_name(ctx, RSTRING_PTR(name));
-}

data/ext/bsdcontrol.rb/glue.h

@@ -1,7 +0,0 @@
-#pragma once
-#include <ruby.h>
-#include <libhbsdcontrol.h>
-
-int bsdcontrol_open(VALUE);
-hbsdctrl_ctx_t* bsdcontrol_unwrap(VALUE);
-hbsdctrl_feature_t* bsdcontrol_find_feature(hbsdctrl_ctx_t*, VALUE);