commit - 625c83c97f21ca7f19e430bc35a05a666c8824bf
commit + e845266448678a874b53e7f9e0d16988815c2c92
blob - f1cf123c468f636b6b2290fd62ca8e6b179ab5ac
blob + 384f347b929513263e880df54a09a6ba700b089e
--- libexec/got-fetch-http/got-fetch-http.c
+++ libexec/got-fetch-http/got-fetch-http.c
int ch;
#if !DEBUG_HTTP || defined(PROFILE)
- if (pledge("stdio rpath inet dns", NULL) == -1)
+ if (pledge("stdio rpath inet dns unveil", NULL) == -1)
err(1, "pledge");
#endif
https = strcmp(argv[0], "https") == 0;
#ifndef PROFILE
- if (!https) {
+ if (https) {
+ if (unveil("/etc/ssl/cert.pem", "r") == -1)
+ err(1, "unveil /etc/ssl/cert.pem");
+ } else {
/* drop "rpath" */
- if (pledge("stdio inet dns", NULL) == -1)
+ if (pledge("stdio inet dns unveil", NULL) == -1)
err(1, "pledge");
}
+#else
+ if (unveil("gmon.out", "rwc") != 0)
+ err(1, "unveil gmon.out");
#endif
+ if (unveil(NULL, NULL) == -1)
+ err(1, "unveil NULL");
+
host = argv[1];
port = argv[2];
path = argv[3];