6 ms·
Not a very insightful comment but I really like the way OpenBSD names system calls - both `unveil` and `pledge` are great, descriptive Unix-y names for what the
by gshrikant 8y ago
Not a very insightful comment but I really like the way OpenBSD names system calls - both `unveil` and `pledge` are great, descriptive Unix-y names for what these system calls do.
- rurban 8y agoReminds me more on Perl naming conventions. Take an arbitrary non technical expression, where established names already do exist, but clash with the semantics. Also the usage of strings for flags and not int bits just let me cry out. This is pure nonsense.
- gshrikant 8y agoPledge (previously `tame`) did use bitmasks in its earlier iterations. See Ted Unangst's post about it: https://www.tedunangst.com/flak/post/string-interfaces https://www.tedunangst.com/flak/post/string-interfaces
- rjvbk 8y agoI don't like it, it's un-C-like.
- arcticbull 8y agoToo many vowels? Would you prefer 'pldg' ? ;) Unless you meant the stringly-typed arguments in which case I'm 100% with you, they're asking for trouble.
- rurban 8y agoI know this change, that's why I bothered. He can do this in his private app as he likes, but not in the libc which is the most widely copied libc. It's about security, consistency and being a positive role model.
- anilakar 8y agoMaybe Theo wanted fopen-like semantics?
- bonzini 8y agofopen is not a system call, it is a library call. The system call is open, and it uses bits for flags.
- int_19h 8y agoWhich makes it that much harder to extend. There's nothing wrong with the use of strings here. It's very readable, easily understandable to anyone who knows C, can be checked by automated tools (or at runtime) for invalid values, and is easily extensible in the future. It's also not on a hot path (I mean, you shouldn't have to do this at any point other than process creation).
- therein 8y agoRight but is there really any reason why the implementation should call strncmp or anything that would be costlier than a bitwise AND? It's not like "r" reads better than O_RDONLY.
- codetrotter 8y agoPledge happens on process startup only, so since it’s not like it is called over and over again during the life of the process, the overhead is certainly negligible for all modern servers, desktops and laptops.
- tedunangst 8y agoIt's like everything else in openbsd. The people who don't use it don't like it; the people who live with it every day for years realize benefits the haters don't perceive.
- setzer22 8y agoI'm curious. To me, unveil means reveal information, while the intended purpose for this tool is to hide it. Why do you think it's such a descriptive name?
- danielparks 8y agoYeah, that was my thought too. This is more like “veil_except”. That said, “unveil” is good enough.
- amelius 8y agoWhy not "restrict"?
- MaxBarraclough 8y agoHere be dragons! "restrict" is a keyword in C.
- makecheck 8y agoIt is stated in the 2nd line of the Description in the manual that this will reveal things with subsequent calls. It’s just the initial call that hides everything.
- jakobegger 8y agoWhile it implicitely hides everything on the first call, it unveils the arguments. Reads really natural. I imagine typical usage would be: fork(); unveil("/home/jakob/", "w"); unveil("/etc/some_config_file", "r"); unveil(0,0); exec();
- matheusmoreira 8y agoI agree. Naming things is so hard. It's always nice when people do manage to come up with terse names.