Мой опенок.

Aleks Michajlow · 3 years ago

Мой опенок.

Aleks Michajlow · 3 years ago

pledge и unveil. Можно кстати внезапно посмотреть в man firefox, там будет

...
SEE ALSO
       /usr/local/share/doc/pkg-readmes/firefox
...

и затем в

...
pledge(2) and unveil(2) Support
===============================
Firefox on OpenBSD is secured with pledge(2) and unveil(2) to limit
the system calls and filesystem access that each of Firefox's process types
(main, content, remote data decoder, audio decoder, socket and GPU) is
permitted.  By default, only ~/Downloads and /tmp can be written to when
downloading files, or when viewing local files as file:// URLs.  You can edit
the following files to change the pledge promises, unveil paths, and associated
permissions:

/etc/firefox/{unveil,pledge}.{main,content,gpu,rdd,socket,utility-audioDecoder}

As unveil() can't show non-existing dirs, it is recommended to manually
create ~/Downloads for files to be properly saved in this directory.

Starting firefox should create this dir though, but it wont be available
for downloads until it's restarted.
...

Ну и сами конфиги выглядят проще некуда:

$ head /etc/firefox/unveil.main                 
# for uuid generation?
/dev/urandom r
/dev/video rw
/dev/video0 rw
/dev/fido rw
# for webgl info in about:support
/dev/dri/card0 rw
/usr/lib r

/etc/fonts r

Человек, который видит это в первый раз - сразу разберется, что к чему.

cocucka · 3 years ago

Да, выглядит понятно и просто, спс за пример.