RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-31 11:28:12 +00:00
Code Issues Activity Actions
serenity/Base/usr/share/man/man2/pledge.md
Andreas Kling 26a31c7efb Kernel: Add "accept" pledge promise for accepting incoming connections 
This patch adds a new "accept" promise that allows you to call accept()
on an already listening socket. This lets programs set up a socket for
for listening and then dropping "inet" and/or "unix" so that only
incoming (and existing) connections are allowed from that point on.
No new outgoing connections or listening server sockets can be created.

In addition to accept() it also allows getsockopt() with SOL_SOCKET
and SO_PEERCRED, which is used to find the PID/UID/GID of the socket
peer. This is used by our IPC library when creating shared buffers that
should only be accessible to a specific peer process.

This allows us to drop "unix" in WindowServer and LookupServer. :^)

It also makes the debugging/introspection RPC sockets in CEventLoop
based programs work again.
2020-01-17 11:19:06 +01:00

2.1 KiB
Raw Blame History

Name

pledge - reduce process capabilities

Synopsis

#include <unistd.h>

int pledge(const char* promises, const char* execpromises);

Description

pledge() makes a promise to the kernel that from this moment on, the calling process will only use a subset of system functionality.

Functionality is divided into a curated set of promises (described below), which can be combined to cover the program's needs. Both arguments are space-separated lists of promises.

Note that pledge() can be called repeatedly to remove previously-pledged promises, but it can never regain capabilities once lost.

promises are applied to the current process, and will also be inherited by children created by fork(2).

execpromises are applied if/when a new process image is created with exec(2).

If promises or execpromises is null, the corresponding value is unchanged.

Promises

  • stdio: Basic I/O, memory allocation, information about self, various non-destructive syscalls
  • thread: The POSIX threading API
  • id: Ability to change UID/GID
  • tty: TTY related functionality
  • proc: Process and scheduling related functionality
  • exec: The exec(2) syscall
  • unix: UNIX local domain sockets
  • inet: IPv4 domain sockets
  • accept: May use accept(2) to accept incoming socket connections on already listening sockets. It also allows getsockopt(2) with SOL_SOCKET and SO_PEERCRED on local sockets
  • rpath: "Read" filesystem access
  • wpath: "Write" filesystem access
  • cpath: "Create" filesystem access
  • dpath: Creating new device files
  • chown: Changing file owner/group
  • fattr: Changing file attributes/permissions
  • shared_buffer: Shared memory buffers
  • chroot: The chroot(2) syscall
  • video: May use ioctl(2) and mmap(2) on framebuffer video devices

Errors

  • EFAULT: promises and/or execpromises are not null and not in readable memory.
  • EINVAL: One or more invalid promises were specified.
  • EPERM: An attempt to increase capabilities was rejected.