I think we should go with Josh's original diff, without the commentary.
I'll commit.
As for the entries not documented in the manual page, the process goes
like this:
1. grep the tree for the programs that use it
2. read kern_pledge.c or lower-level code to find out what operations
are
Josh Rickmar writes:
> On Wed, Jun 09, 2021 at 06:01:59PM +, Klemens Nanni wrote:
>> > There were three promises which are not documented in pledge(2):
>> > disklabel, drm, and vmm. I've just left these at the end.
>> Sounds good.
>
> Are the undocumented promises intentional, or bugs in
@ static const struct {
uint64_tbits;
const char *name;
} pledgenames[] = {
+ /* match pledge(2) order for ps(1) to print */
+ { PLEDGE_STDIO, "stdio" },
{ PLEDGE_RPATH, "rpath" },
{ PLEDGE_WPATH,
/sys/pledge.h
> @@ -76,42 +76,42 @@ static const struct {
> uint64_t bits;
> const char *name;
/* match pledge(2) order for ps(1) to print */
> } pledgenames[] = {
> + { PLEDGE_STDIO, "stdio" },
> { PLEDGE_RPATH,
On Wed, Jun 09, 2021 at 09:01:34AM -0600, Theo de Raadt wrote:
> Josh Rickmar wrote:
>
> > I figure that the manpage is probably the more consulted reference,
> > and the order that is preferred, so the patch below reorders the
> > promise names in pledge.h to match.
>
> The current array was
Josh Rickmar wrote:
> I figure that the manpage is probably the more consulted reference,
> and the order that is preferred, so the patch below reorders the
> promise names in pledge.h to match.
The current array was value-sorted (by the bit value) to allow binary
search. However no code is
I was surprised to find that ps -O pledge did not list the pledge
promise names in the same order as the pledge(2) manpage. Besides
lacking consistency, this was also making it difficult to quickly find
which promises are not granted to a process which requires most of
them (e.g. chrome).
I
