implemented pledge and unveil

pkg/cli/cli.go

@@ -14,6 +14,7 @@ import (
 	"strings"
 	"text/tabwriter"
 
+	"git.giftfish.de/ston1th/godrop/v2"
 	apiclient "git.giftfish.de/ston1th/keyctl/pkg/api/client"
 	clientv1 "git.giftfish.de/ston1th/keyctl/pkg/api/v1/client"
 	"git.giftfish.de/ston1th/keyctl/pkg/api/v1/schema"
@@ -29,6 +30,17 @@ func exit(err error) {
 
 func Run(arg string) {
 	ctx := context.Background()
+	pledge := "stdio unveil"
+	switch arg {
+	case "new", "ls", "req", "approve", "reject", "del":
+		pledge += " unix"
+	case "get":
+		pledge += " unix inet dns"
+	}
+	err := godrop.PledgePromises(pledge)
+	if err != nil {
+		exit(err)
+	}
 	switch arg {
 	case "new":
 		name, existing, encoding, t, size, err := newKeyFlags()
@@ -148,6 +160,12 @@ func client() (c *clientv1.Client) {
 		exit(err)
 	}
 	apic := apiclient.NewClient(opts...)
+	if socket, ok := apic.IsUnix(); ok {
+		err = unveil(socket)
+		if err != nil {
+			exit(err)
+		}
+	}
 	c, err = clientv1.NewClient(apic)
 	if err != nil {
 		exit(err)
@@ -155,6 +173,14 @@ func client() (c *clientv1.Client) {
 	return
 }
 
+func unveil(socket string) error {
+	err := godrop.Unveil(socket, "rwc")
+	if err != nil {
+		return err
+	}
+	return godrop.UnveilBlock()
+}
+
 func jsonOutput(v any) {
 	b, err := json.Marshal(v)
 	if err != nil {