dma-mbox-create: Restrict with Capsicum

[cem]

Summary

The restriction here is pretty late and pretty minimal. We need a lot
of authority to open password databases, and don't do much after that
point.

Test Plan

• sudo truss /usr/libexec/dma-mbox-create cmeyer

[lifanov_mail.lifanov.com]

Hi! Do we want to ifdef the capsicum part? We share this code with DragonFly, https://github.com/corecode/dma (which is where our port comes from), and the latter is used in Debian. I also pull this code and build it for CentOS.

[emaste]

In D7988#165295, @lifanov_mail.lifanov.com wrote:

Hi! Do we want to ifdef the capsicum part? We share this code with DragonFly, https://github.com/corecode/dma (which is where our port comes from), and the latter is used in Debian. I also pull this code and build it for CentOS.

It's definitely best if we can share an unmodified version of this with other operating systems, so #ifdefing the Capsicum-specific chagnes seems reasonable to me.

[cem]

Easily done!

[emaste]

FYI we #ifdef'd bspatch as FreeBSD is upstream and other software may pull from us,
https://svnweb.freebsd.org/base/head/usr.bin/bsdiff/bspatch/bspatch.c?view=markup
having the small refactoring here (the maildirfd) upstream should be useful in other operating systems with some sandboxing technology

[cem]

Ifdef Capsicum support (FreeBSD-only for now) for code-sharing with DragonFly
and Linux.

[cem]

In D7988#165300, @emaste wrote:

FYI we #ifdef'd bspatch as FreeBSD is upstream and other software may pull from us,
https://svnweb.freebsd.org/base/head/usr.bin/bsdiff/bspatch/bspatch.c?view=markup
having the small refactoring here (the maildirfd) upstream should be useful in other operating systems with some sandboxing technology

Right. Most of these changes are not FreeBSD-specific, so I only ifdef'd the Capsicum-exclusive bits.

[emaste]

contrib/dma/dma-mbox-create.c

178–185 ↗

(On Diff #20584)

do we still need fn?
I think it would be fine to print just the user (e.g. open mbox for user '%s'", or if we want the path do %s/%s.

[emaste]

Considering sending this as a pull request for upstream: https://github.com/emaste/dma/commit/6748bdd435e6287cb36ea278fec2a1f7281be6bf

[cem]

In D7988#167172, @emaste wrote:

Considering sending this as a pull request for upstream: https://github.com/emaste/dma/commit/6748bdd435e6287cb36ea278fec2a1f7281be6bf

Yeah, that looks fine to me. Go ahead. (Can you CC me on the PR?)

[cem]

Rebase over Ed's maildirfd patch.

[cem]

Use capsicum helpers for tz and nls caching.

[cem]

Is this too useless to commit? Nothing beyond sandbox entry seems even remotely exploitable.