| Age | Commit message (Collapse) | Author |
|---|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
my style was: 2 tabs. bsd-style, for extending a line, is
4 spaces. this style has grown on me, so let's do it here
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
my style of C programming is this: always return errno
upon exit from the program, or from a thread.
handle errno in the calling/forking function.
returning errno at the end of main has this intention:
if an unhandled error occured, the program exits with
non-zero status.
a correctly written program should *never* return non-zero
at the end of main, and if it does, this indicates a bug
in the code (per my code style / philosophy).
so, warn the user with a message if this occurs. the
intention is that this message should never be printed.
do not use assert() for this. i don't believe in that.
such a test should always be present, for everyone.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
This version of spkmodem uses err() to indicate an error,
and the value of errno is used as exit status at all times,
even when it is zero.
When calling err(), it is intended that errno always be
non-zero, so modify the code accordingly.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
also be more thorough about errno value when calling
pledge. rename variable in a for loop for clarity.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
when calling fread(), errno may be set to EOVEFLOW if
the range being read will cause an integer overflow
if end-of-file is reached, errno may not be set. when
calling this function, you must check errno or check
feof() - ferror() should also be checked, so this check
is added immediately afterwards in the code
ferror() does not set errno, so ERR() is used to set
errno to ECANCELED as program exit status
further separate reading of frames into a new function
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
The mentality behind pledge and unveil is that you should
think ahead, so that large parts of code can run under
extremely tight restrictions.
The pledge calls have been adjusted accordingly, also.
Disallow all unveil calls after the gbe file and the
file /dev/urandom have been unveiled.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
also remove wpath if using the dump command
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
in practise, no other condition would be met and the
program still worked. this is a pre-emptive fix.
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Also hardened the pledges.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
This replaces a check in the function for O_RDONLY, and
fixes the bug where the "dump" command triggers such error.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
*Open* files at the start, then unveil. The same overall
behaviour is observed. In the case that invalid arguments
are given, simply opening a file does not cause much
performance impact (if any).
Restrict operations as early as possible in code.
Bonus:
writeGbeFile also hardened; if flags is O_RDONLY, it aborts.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
i screwed up in an earlier commit
this change fixes a bug where on rhex(), each
call would re-open /dev/urandom, resetting rfd
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
in practise, the file was never written unless the checksum
was valid, but in the same of sloccount reduction i made it
do the swap/copy before checking. while functionally ok, it
never sat right with me. this is one example of where sloc
count doesn't mean everything. code correctness is critical
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
the style was already quite similar, but extended lines in
bsd are indented by 4 spaces instead of a tab. this style
has grown on me, so i'm adopting it here
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
They don't precisely *pertain* to nvmutil, but they are
useful helper functions for calling pledge/unveil in
OpenBSD. Ideally, the main file should only contain core
logic pertaining to the execution of *nvmutil*.
Put xpledge() and xunveil() in nvmutil.h.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
|
|
There is nothing cooler than a macro.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
eventually, everything will be a macro!
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
|
|
When err() is called, it is intended that nvmutil will
always exit with non-zero status, but with errno as the
return value. Ensure that errno is *not* zero.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Make word() a macro, simplify err_if().
Could also make setWord() a macro if I forego certain
optimisations, but I'll leave it as-is.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
This change also reduces code indentation.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
After /dev/urandom (for MAC address randomisation) and
the GbE file have been handled, unveil them. Unveil is
a system call provided by OpenBSD that, when called,
restricts access only to the files and/or directories
specified, each given specific permissions.
You can learn more about unveil here:
https://man.openbsd.org/unveil.2
An ifdef rule makes nvmutil only use unveil on OpenBSD,
because it's not available anywhere else. This is the same
as with the pledge() system call.
Where invalid arguments are given, and no action performed,
pledge promises are also reduced to just stdio, preventing
any writes to files, or reads from files.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
After reading a file, remove rpath.
When removing rpath, also remove wpath if flags
are not to O_RDONLY (read-only disk operation).
When wpath is permitted, and a file was successfully
written, remove wpath.
In order to permit /dev/urandom access in rhex(),
I call it as a void just before re-calling pledge.
The rhex() function has been written in such a way
that /dev/urandom only needs to be read *once*.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Define xpledge which calls pledge and handles errors.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
I assumed wpath was all that's needed, but this simply
allows writes.
rpath must be specified alongside wpath, for reads.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
The utils that are pledged checked HAVE_PLEDGE which was
bogus. OpenBSD defines __OpenBSD__, which you can check
for in ifdef.
This change makes nvmutil and spkmodem-recv *actually*
use pledge, when the utils are compiled on OpenBSD.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
It will only be used on OpenBSD. Other operating
systems will behave in the same way.
Pledge is feature specific to OpenBSD that
restricts system operations, for security:
https://man.openbsd.org/pledge.2
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
printf outputs to stdout, which is line buffered
by default.
Adding a -u option to disable buffering.
Exit when a non-support flag is given, but adhere
to current behaviour when no flag is given.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
They do not need to be initialised zero, because
global variables are always zero by default,
unless set differently by the programmer.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
It is only used by a single function.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
