Re: pledge from command line

2017-04-27 Thread Stuart Henderson
On 2017-04-27, Ted Unangst wrote: > Michael Hendricks wrote: >> I would like to have pledge on the command line so I can restrict an ad-hoc >> process during execution. For example: >> >> $ pledge "stdio" sed -e "s/foo/bar/g" output.txt >> >> I can't modify sed, for example, because I don't alw

Re: pledge from command line

2017-04-27 Thread Theo de Raadt
> Michael Hendricks wrote: > > I would like to have pledge on the command line so I can restrict an ad-hoc > > process during execution. For example: > > > > $ pledge "stdio" sed -e "s/foo/bar/g" output.txt > > > > I can't modify sed, for example, because I don't always want it pledged > > that

Re: pledge from command line

2017-04-27 Thread Ted Unangst
Michael Hendricks wrote: > I would like to have pledge on the command line so I can restrict an ad-hoc > process during execution. For example: > > $ pledge "stdio" sed -e "s/foo/bar/g" output.txt > > I can't modify sed, for example, because I don't always want it pledged > that tightly. Since

Re: pledge from command line

2017-04-27 Thread Theo de Raadt
That is not possible. pledge only works on behalf of a process itself. In the simplest case, a call to pledge is done between the first part of a program "initialization" and the second part of a program "main loop". It serves no purpose if done earlier, and as you noted execve resets pledge, to