ident(1): Capsicumify

[cem]

Summary

As usual for a first cut, punt on sandboxing multiple files and just
sandbox the last input file.

Test Plan

• kyua test passed (1/1)
• ident tests/test.in tests/test.in tests/test.in /dev/stdin (multiple files)
• ident (tty input)
• ident < tests/test.in (non-tty stdin)

[bapt]

It would be nicer to fork and cap_enter for each arguments but the last one if there are more than 1 arguments, what do you think?

[cem]

In D7918#164191, @bapt wrote:

It would be nicer to fork and cap_enter for each arguments but the last one if there are more than 1 arguments, what do you think?

I'd prefer to defer multiple-argument support to a follow-up patch.

[bapt]

what about an open(/) then replace fopen with openat/fdopen that would avoid a fork and will make it work properly

[bapt]

The approach I have in mind is equivalent to D7936

[allanjude]

usr.bin/ident/ident.c

266 ↗

(On Diff #20415)

Since this application already has the processing split out, you could do an array of fp's (malloc fp * argc - 1) then cap_enter and do a second for loop for the scan()

or do the fork() thing

[bapt]

usr.bin/ident/ident.c

266 ↗

(On Diff #20415)

I still find my open("/", O_DIRECTORY) approach nicer than what you propose :)

[cem]

In D7918#164209, @bapt wrote:

what about an open(/) then replace fopen with openat/fdopen that would avoid a fork and will make it work properly

This requires resolving all paths into absolute paths, right? Why not open the current working directory and openat on that? Or does openat in the sandbox actually restrict to paths below dirfd?

[cem]

In D7918#164437, @cem wrote:

Why not open the current working directory and openat on that? Or does openat in the sandbox actually restrict to paths below dirfd?

Answer: yes, openat can't open paths above fd in capability mode.

[cem]

• Group multiple related capability restrictions into a single if clause.
• Preopen input files; enter capability mode for all processing.

[emaste]

Can update to use capsicum helpers

usr.bin/ident/ident.c

266 ↗

(On Diff #20415)

One problem with that approach is paths containing .. are (currently, see D8110) disallowed in capability mode.

[cem]

Update to use helpers.