implemented pledge and unveil on openbsd

cmd/cachefs/main.go

@@ -14,8 +14,10 @@ import (
 
 	"cachefs/pkg/config"
 	"cachefs/pkg/fs"
+	"cachefs/pkg/provider/parse"
 	"cachefs/pkg/srv"
 
+	"git.giftfish.de/ston1th/godrop/v2"
 	"github.com/go-logr/logr"
 	"k8s.io/klog/v2"
 	"k8s.io/klog/v2/klogr"
@@ -41,6 +43,11 @@ func main() {
 		klog.Fatalf("init failed: %s", err)
 	}
 
+	err = dropPrivs(c)
+	if err != nil {
+		klog.Fatalf("init failed: %s", err)
+	}
+
 	if fs.SetBufferSize(c.Cache.Buffer) {
 		log.V(2).Info("changed preload buffer size", "size", c.Cache.Buffer)
 	}
@@ -147,3 +154,32 @@ func main() {
 	log.Info("cachefs shutdown completed")
 	os.Exit(0)
 }
+
+func dropPrivs(cfg *config.Config) (err error) {
+	// flock fattr
+	err = godrop.PledgePromises("stdio rpath wpath cpath inet dns unveil")
+	if err != nil {
+		return
+	}
+	err = godrop.Unveil(cfg.Cache.Metadata, "rwc")
+	if err != nil {
+		return
+	}
+	for _, p := range parse.Paths(cfg.Cache.Src.Path) {
+		err = godrop.Unveil(p, "r")
+		if err != nil {
+			return
+		}
+	}
+	for i, p := range parse.Paths(cfg.Cache.Dst.Path) {
+		if i == 0 {
+			err = godrop.Unveil(p, "rwc")
+		} else {
+			err = godrop.Unveil(p, "r")
+		}
+		if err != nil {
+			return
+		}
+	}
+	return godrop.UnveilBlock()
+}