util/nvmutil: Use unveil, and harden pledges

After /dev/urandom (for MAC address randomisation) and
the GbE file have been handled, unveil them. Unveil is
a system call provided by OpenBSD that, when called,
restricts access only to the files and/or directories
specified, each given specific permissions.

You can learn more about unveil here:

https://man.openbsd.org/unveil.2

An ifdef rule makes nvmutil only use unveil on OpenBSD,
because it's not available anywhere else. This is the same
as with the pledge() system call.

Where invalid arguments are given, and no action performed,
pledge promises are also reduced to just stdio, preventing
any writes to files, or reads from files.

Signed-off-by: Leah Rowe <leah@libreboot.org>

0 files changed, 0 insertions, 0 deletions