ioctl BIOCVERSION command causes SIGABRT after pledge(2) with all promises from the manpage

2023-01-27 Thread roy hills
I'm using pledge(2) to harden an application on OpenBSD, but cannot find a promise that will allow it to run. Even after adding all the promises listed in the pledge manpage (apart from "error") it still fails with SIGABRT. I'm calling this: pledge("stdio rpath wpath cpath dpath tmppath inet mca

Re: ioctl BIOCVERSION command causes SIGABRT after pledge(2) with all promises from the manpage

2023-01-27 Thread Ricardo Mestre
https://media.tenor.com/jGgmfDOxmuMC/ryan-reynolds-but-why.gif

Re: ioctl BIOCVERSION command causes SIGABRT after pledge(2) with all promises from the manpage

2023-01-27 Thread Stuart Henderson
On 2023-01-27, Ricardo Mestre wrote: > https://media.tenor.com/jGgmfDOxmuMC/ryan-reynolds-but-why.gif I'm not sure this is entirely helpful to someone who is coming from outside OpenBSD and learning how pledge works while helpfully upstreaming pledge support to their software... On 2023-01-

Re: ioctl BIOCVERSION command causes SIGABRT after pledge(2) with all promises from the manpage

2023-01-27 Thread Theo de Raadt
pledge("everything", NULL) is not the same as not calling pledge. roy hills wrote: > I'm using pledge(2) to harden an application on OpenBSD, but cannot find > a promise that will allow it to run. Even after adding all the promises > listed in the pledge manpage (apart from "error") it still fa

Re: ioctl BIOCVERSION command causes SIGABRT after pledge(2) with all promises from the manpage

2023-01-27 Thread roy hills
Re: ioctl BIOCVERSION command causes SIGABRT after pledge(2) with all promises from the manpage pledge("everything", NULL) is not the same as not calling pledge. roy hills wrote: > I'm using pledge(2) to harden an application on OpenBSD, but cannot > find a promise that wi

Re: ioctl BIOCVERSION command causes SIGABRT after pledge(2) with all promises from the manpage

2023-01-27 Thread Theo de Raadt
lroy hills wrote: > Thanks for the info. Does that mean there are some functions that aren't > covered by any of the available promises? If so I guess this ioctl() might be > an example. Intentionally. > I'm not actually trying to pledge everything - that was just me trying to find > out what