pledge 1.0.0 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 1ff2e2250fd7b7b8b8edab08f84d75d1140b75ee
-  data.tar.gz: 14e9e9cdc750d16d575e014e5e5b29769816f19d
+SHA256:
+  metadata.gz: 7369f71bb2bfdbbea7dd07d98c86f443b8c0a09ddaf13090c6c0a379c2fe6eed
+  data.tar.gz: bea75bb0d79544311c633aeb04ad7bcb3d2061ace0c6f9f0829e05dd387068e0
 SHA512:
-  metadata.gz: a5e05296eac3da536dbf96189899d810baecef6c791ef9f356628f2f81a04c13f00a892247cf7e9495749f357e9316aefe6b5af324a8361112925861f1786b45
-  data.tar.gz: 3f7e3289b7011e2b54eac6b1ce35798667dda2d08b51815517a57b6476255ffd3628bb37fee313d24f4649a1f0bc654af1590bf0617401a5a8381fdebff16c06
+  metadata.gz: 4031731b34fe1c2497cfa84ffad17b698ada329362cbb0f8730ea2bfa4f094c0429150b92364a8764d04eef1397be3cdb7d70145ccc9ea88b6e0dadb425d36b7
+  data.tar.gz: 3509a67789e3876149e8880bc031fdb0d5df2bf111cd65b7f112132b1dd64696ff38ef9f70efc854d5ba99eb4c83d1256b4d68ba5805e879725fc5e6ed14a735

data/CHANGELOG

@@ -1,3 +1,7 @@
+=== 1.1.0 (2019-04-25)
+
+* Support execpromises as optional second argument to Pledge.pledge (jeremyevans)
+
 === 1.0.0 (2016-11-04)
 
 * Initial Public Release

data/MIT-LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2016 Jeremy Evans
+Copyright (c) 2016,2019 Jeremy Evans
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to

data/README.rdoc

@@ -8,7 +8,8 @@ use a wide variety of operations on initialization, but
 a fewer number after initialization (when user input will
 be accepted).
 
-plege(2) is supported on OpenBSD 5.9+.
+pledge(2) is supported on OpenBSD 5.9+. pledge(2) supports a second
+argument for execpromises on OpenBSD 6.3+.
 
 == Usage
 
@@ -20,7 +21,7 @@ Then you can use +Pledge.pledge+ as the interface to the pledge(2)
 system call.  You pass +Pledge.pledge+ a string containing tokens
 for the operations you would like to allow (called promises).
 For example, if you want to give the process the ability to read
-from the the file system, but not read from the file system or
+from the file system, but not write to the file system or
 allow network access:
 
   Pledge.pledge("rpath")
@@ -34,6 +35,18 @@ filesystem access:
 
   Pledge.pledge("inet unix dns")
 
+If you want to use pledging in a console application such as
+irb or pry, you must include the tty promise:
+
+  Pledge.pledge("tty rpath")
+
+You can pass a second string argument containing tokens for
+the operations you would like to allow in spawned processes
+(called execpromises).  To allow spawning processes that have
+read/write filesystem access only, but not network access:
+
+  Pledge.pledge("proc exec rpath", "stdio rpath wpath cpath")
+
 +Pledge+ is a module that extends itself, you can include it
 in other classes:
 
@@ -43,12 +56,12 @@ in other classes:
 == Options
 
 See the pledge(2) man page for a description of the allowed
-promises in the string passed to +Pledge.pledge+.
+promises in the strings passed to +Pledge.pledge+.
 
 Using an unsupported promise will raise an exception.  The "stdio"
-promise is added automatically, as ruby does not function without
-
-it. 
+promise is added automatically to the current process's promises,
+as ruby does not function without it, but it is not added to
+the execpromises (as you can execute non-ruby programs).
 
 == Reporting issues/bugs
 
@@ -85,15 +98,6 @@ task.  This will compile the library if not already compiled.
 
   rake
 
-== Known Issues
-
-* You cannot create new threads after running +Pledge.pledge+, as
-  it uses syscalls that are not currently allowed by pledge(2).  +fork+
-  still works, assuming you are using the +proc+ pledge.
-
-* You cannot currently test +Pledge.pledge+ in irb/pry, as they use an
-  ioctl that is not currently allowed by pledge(2).
-
 == Author
 
 Jeremy Evans <code@jeremyevans.net>

data/ext/pledge/pledge.c

@@ -6,16 +6,31 @@ static VALUE ePledgeInvalidPromise;
 static VALUE ePledgePermissionIncreaseAttempt;
 static VALUE ePledgeError;
 
-static VALUE rb_pledge(VALUE pledge_class, VALUE promises) {
-  SafeStringValue(promises);
-  promises = rb_str_dup(promises);
+static VALUE rb_pledge(int argc, VALUE* argv, VALUE pledge_class) {
+  VALUE promises = Qnil;
+  VALUE execpromises = Qnil;
+  const char * prom = NULL;
+  const char * execprom = NULL;
 
-  /* required for ruby to work */
-  rb_str_cat2(promises, " stdio");
-  promises = rb_funcall(promises, rb_intern("strip"), 0);
-  SafeStringValue(promises);
+  rb_scan_args(argc, argv, "11", &promises, &execpromises);
 
-  if (pledge(RSTRING_PTR(promises), NULL) != 0) {
+  if (!NIL_P(promises)) {
+    SafeStringValue(promises);
+    promises = rb_str_dup(promises);
+
+    /* required for ruby to work */
+    rb_str_cat2(promises, " stdio");
+    promises = rb_funcall(promises, rb_intern("strip"), 0);
+    SafeStringValue(promises);
+    prom = RSTRING_PTR(promises);
+  }
+
+  if (!NIL_P(execpromises)) {
+    SafeStringValue(execpromises);
+    execprom = RSTRING_PTR(execpromises);
+  }
+
+  if (pledge(prom, execprom) != 0) {
     switch(errno) {
     case EINVAL:
         rb_raise(ePledgeInvalidPromise, "invalid promise in promises string");
@@ -32,7 +47,7 @@ static VALUE rb_pledge(VALUE pledge_class, VALUE promises) {
 void Init_pledge(void) {
   VALUE cPledge;
   cPledge = rb_define_module("Pledge");
-  rb_define_method(cPledge, "pledge", rb_pledge, 1);
+  rb_define_method(cPledge, "pledge", rb_pledge, -1);
   rb_extend_object(cPledge, cPledge);
   ePledgeError = rb_define_class_under(cPledge, "Error", rb_eStandardError);
   ePledgeInvalidPromise = rb_define_class_under(cPledge, "InvalidPromise", ePledgeError);

data/spec/pledge_spec.rb

@@ -1,12 +1,17 @@
 require './lib/pledge'
 
 require 'rubygems'
+ENV['MT_NO_PLUGINS'] = '1' # Work around stupid autoloading of plugins
 gem 'minitest'
 require 'minitest/autorun'
 
 RUBY = ENV['RUBY'] || 'ruby'
 
 describe "Pledge.pledge" do
+  def execpledged(promises, execpromises, code)
+    system(RUBY, '-I', 'lib', '-r', 'pledge', '-e', "Pledge.pledge(#{promises.inspect}, #{execpromises.inspect}); #{code}")
+  end
+
   def _pledged(status, promises, code)
     system(RUBY, '-I', 'lib', '-r', 'pledge', '-e', "Pledge.pledge(#{promises.inspect}); #{code}").must_equal status
   end
@@ -109,4 +114,25 @@ describe "Pledge.pledge" do
     end
     us.accept.read.must_equal 't'
   end
+
+  it "should raise ArgumentError if given in invalid number of arguments" do
+    proc{Pledge.pledge()}.must_raise ArgumentError
+    proc{Pledge.pledge("", "", "")}.must_raise ArgumentError
+  end
+
+  it "should handle both promises and execpromises arguments" do
+    execpledged("proc exec rpath", "stdio rpath", "exit(`cat MIT-LICENSE` == File.read('MIT-LICENSE') ? 0 : 1)").must_equal true
+    execpledged("proc exec", "stdio rpath", "$stderr.reopen('/dev/null', 'w'); exit(`cat MIT-LICENSE` == File.read('MIT-LICENSE') ? 0 : 1)").must_equal false
+    execpledged("proc exec rpath", "stdio", "$stderr.reopen('/dev/null', 'w'); exit(`cat MIT-LICENSE` == File.read('MIT-LICENSE') ? 0 : 1)").must_equal false
+  end
+
+  it "should handle nil arguments" do
+    Pledge.pledge(nil).must_be_nil
+    Pledge.pledge(nil, nil).must_be_nil
+    execpledged("proc exec rpath", nil, "`cat MIT-LICENSE`").must_equal true
+    execpledged("", nil, "`cat MIT-LICENSE`").must_equal false
+    execpledged(nil, "stdio rpath", "`cat MIT-LICENSE`").must_equal true
+    execpledged(nil, "stdio", "File.read('MIT-LICENSE')").must_equal true
+    execpledged(nil, "stdio", "$stderr.reopen('/dev/null', 'w'); exit(`cat MIT-LICENSE` == File.read('MIT-LICENSE') ? 0 : 1)").must_equal false
+  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: pledge
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.1.0
 platform: ruby
 authors:
 - Jeremy Evans
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-11-03 00:00:00.000000000 Z
+date: 2019-04-25 00:00:00.000000000 Z
 dependencies: []
 description: |
   pledge exposes OpenBSD's pledge(2) system call to ruby, allowing a
@@ -60,8 +60,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.5.1
+rubygems_version: 3.0.3
 signing_key: 
 specification_version: 4
 summary: Restrict system operations on OpenBSD