Initial support for pledges in openssl(1) commands.

openssl(1) has two mechanisms for operating: either a single execution
of one command (looking at argv[0] or argv[1]) or as an interactive
session than may execute any number of commands.

We already have a top level pledge that should cover all commands
and that's what interactive mode must continue using.  However, we can
tighten up the pledges when only executing one command.

This is an initial stab at support and may contain regressions.  Most
commands only need "stdio rpath wpath cpath".  The pledges could be
further restricted by evaluating the situation after parsing options.

deraadt@ and beck@ are roughly fine with this approach.

diff --git a/usr.bin/openssl/apps.h b/usr.bin/openssl/apps.h
index bb9fd0d..4813fa3 100644 (file)
--- a/usr.bin/openssl/apps.h
+++ b/usr.bin/openssl/apps.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: apps.h,v 1.16 2015/09/13 12:41:01 bcook Exp $ */
+/* $OpenBSD: apps.h,v 1.17 2015/10/10 22:28:51 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -126,6 +126,9 @@
 #include <openssl/ocsp.h>
 #endif
 
+#include <unistd.h>
+extern int single_execution;
+
 extern CONF *config;
 extern char *default_config_file;
 extern BIO *bio_err;

diff --git a/usr.bin/openssl/asn1pars.c b/usr.bin/openssl/asn1pars.c
index da3bf76..2ce9d1a 100644 (file)
--- a/usr.bin/openssl/asn1pars.c
+++ b/usr.bin/openssl/asn1pars.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: asn1pars.c,v 1.4 2015/08/19 18:25:31 deraadt Exp $ */
+/* $OpenBSD: asn1pars.c,v 1.5 2015/10/10 22:28:51 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -247,6 +247,11 @@ asn1parse_main(int argc, char **argv)
        BUF_MEM *buf = NULL;
        ASN1_TYPE *at = NULL;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        memset(&asn1pars_config, 0, sizeof(asn1pars_config));
 
        asn1pars_config.informat = FORMAT_PEM;

diff --git a/usr.bin/openssl/ca.c b/usr.bin/openssl/ca.c
index e32abcd..0b246ae 100644 (file)
--- a/usr.bin/openssl/ca.c
+++ b/usr.bin/openssl/ca.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ca.c,v 1.16 2015/09/21 13:31:26 bcook Exp $ */
+/* $OpenBSD: ca.c,v 1.17 2015/10/10 22:28:51 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -286,6 +286,11 @@ ca_main(int argc, char **argv)
        const char *errstr = NULL;
        DB_ATTR db_attr;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        conf = NULL;
        key = NULL;
        section = NULL;

diff --git a/usr.bin/openssl/certhash.c b/usr.bin/openssl/certhash.c
index 77e641c..bd0ac54 100644 (file)
--- a/usr.bin/openssl/certhash.c
+++ b/usr.bin/openssl/certhash.c
@@ -649,6 +649,11 @@ certhash_main(int argc, char **argv)
        int argsused;
        int i, cwdfd, ret = 0;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        memset(&certhash_config, 0, sizeof(certhash_config));
 
        if (options_parse(argc, argv, certhash_options, NULL, &argsused) != 0) {

diff --git a/usr.bin/openssl/ciphers.c b/usr.bin/openssl/ciphers.c
index 18b8d3e..caa4085 100644 (file)
--- a/usr.bin/openssl/ciphers.c
+++ b/usr.bin/openssl/ciphers.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ciphers.c,v 1.6 2015/08/19 18:25:31 deraadt Exp $ */
+/* $OpenBSD: ciphers.c,v 1.7 2015/10/10 22:28:51 doug Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -81,6 +81,11 @@ ciphers_main(int argc, char **argv)
        int i, rv = 0;
        char *desc;
 
+       if (single_execution) {
+               if (pledge("stdio rpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        memset(&ciphers_config, 0, sizeof(ciphers_config));
 
        if (options_parse(argc, argv, ciphers_options, &cipherlist,

diff --git a/usr.bin/openssl/cms.c b/usr.bin/openssl/cms.c
index fccac23..29429f5 100644 (file)
--- a/usr.bin/openssl/cms.c
+++ b/usr.bin/openssl/cms.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cms.c,v 1.3 2015/09/11 14:30:23 bcook Exp $ */
+/* $OpenBSD: cms.c,v 1.4 2015/10/10 22:28:51 doug Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
  */
@@ -135,6 +135,11 @@ cms_main(int argc, char **argv)
 
        X509_VERIFY_PARAM *vpm = NULL;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        args = argv + 1;
        ret = 1;
 

diff --git a/usr.bin/openssl/crl.c b/usr.bin/openssl/crl.c
index 4ab9e6c..47173ec 100644 (file)
--- a/usr.bin/openssl/crl.c
+++ b/usr.bin/openssl/crl.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: crl.c,v 1.7 2015/08/22 16:36:05 jsing Exp $ */
+/* $OpenBSD: crl.c,v 1.8 2015/10/10 22:28:51 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -230,6 +230,11 @@ crl_main(int argc, char **argv)
        const EVP_MD *digest;
        char *digest_name = NULL;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        if (bio_out == NULL) {
                if ((bio_out = BIO_new(BIO_s_file())) != NULL) {
                        BIO_set_fp(bio_out, stdout, BIO_NOCLOSE);

diff --git a/usr.bin/openssl/crl2p7.c b/usr.bin/openssl/crl2p7.c
index 4df986d..3935bd1 100644 (file)
--- a/usr.bin/openssl/crl2p7.c
+++ b/usr.bin/openssl/crl2p7.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: crl2p7.c,v 1.4 2015/08/22 16:36:05 jsing Exp $ */
+/* $OpenBSD: crl2p7.c,v 1.5 2015/10/10 22:28:51 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -169,6 +169,11 @@ crl2pkcs7_main(int argc, char **argv)
        STACK_OF(X509) *cert_stack = NULL;
        int ret = 1;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        memset(&crl2p7_config, 0, sizeof(crl2p7_config));
 
        crl2p7_config.informat = FORMAT_PEM;

diff --git a/usr.bin/openssl/dgst.c b/usr.bin/openssl/dgst.c
index 94d98ac..b4632ee 100644 (file)
--- a/usr.bin/openssl/dgst.c
+++ b/usr.bin/openssl/dgst.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dgst.c,v 1.6 2015/09/11 14:30:23 bcook Exp $ */
+/* $OpenBSD: dgst.c,v 1.7 2015/10/10 22:28:51 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -123,6 +123,11 @@ dgst_main(int argc, char **argv)
        char *mac_name = NULL;
        STACK_OF(OPENSSL_STRING) * sigopts = NULL, *macopts = NULL;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        if ((buf = malloc(BUFSIZE)) == NULL) {
                BIO_printf(bio_err, "out of memory\n");
                goto end;

diff --git a/usr.bin/openssl/dh.c b/usr.bin/openssl/dh.c
index f4112e8..7e8d65d 100644 (file)
--- a/usr.bin/openssl/dh.c
+++ b/usr.bin/openssl/dh.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh.c,v 1.6 2015/09/11 14:30:23 bcook Exp $ */
+/* $OpenBSD: dh.c,v 1.7 2015/10/10 22:28:51 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -158,6 +158,11 @@ dh_main(int argc, char **argv)
        BIO *in = NULL, *out = NULL;
        int ret = 1;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        memset(&dh_config, 0, sizeof(dh_config));
 
        dh_config.informat = FORMAT_PEM;

diff --git a/usr.bin/openssl/dhparam.c b/usr.bin/openssl/dhparam.c
index 158a07a..55b7566 100644 (file)
--- a/usr.bin/openssl/dhparam.c
+++ b/usr.bin/openssl/dhparam.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dhparam.c,v 1.6 2015/09/11 14:30:23 bcook Exp $ */
+/* $OpenBSD: dhparam.c,v 1.7 2015/10/10 22:28:51 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -243,6 +243,11 @@ dhparam_main(int argc, char **argv)
        int ret = 1;
        int i;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        memset(&dhparam_config, 0, sizeof(dhparam_config));
 
        dhparam_config.informat = FORMAT_PEM;

diff --git a/usr.bin/openssl/dsa.c b/usr.bin/openssl/dsa.c
index 813e163..2c4feea 100644 (file)
--- a/usr.bin/openssl/dsa.c
+++ b/usr.bin/openssl/dsa.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dsa.c,v 1.5 2015/09/11 14:30:23 bcook Exp $ */
+/* $OpenBSD: dsa.c,v 1.6 2015/10/10 22:28:51 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -240,6 +240,11 @@ dsa_main(int argc, char **argv)
        BIO *in = NULL, *out = NULL;
        char *passin = NULL, *passout = NULL;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        memset(&dsa_config, 0, sizeof(dsa_config));
 
        dsa_config.pvk_encr = 2;

diff --git a/usr.bin/openssl/dsaparam.c b/usr.bin/openssl/dsaparam.c
index 0cdd5c1..7324949 100644 (file)
--- a/usr.bin/openssl/dsaparam.c
+++ b/usr.bin/openssl/dsaparam.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dsaparam.c,v 1.5 2015/09/11 14:30:23 bcook Exp $ */
+/* $OpenBSD: dsaparam.c,v 1.6 2015/10/10 22:28:51 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -168,6 +168,11 @@ dsaparam_main(int argc, char **argv)
        int numbits = -1;
        char *strbits = NULL;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        memset(&dsaparam_config, 0, sizeof(dsaparam_config));
 
        dsaparam_config.informat = FORMAT_PEM;

diff --git a/usr.bin/openssl/ec.c b/usr.bin/openssl/ec.c
index d5fe68f..b4e2fe1 100644 (file)
--- a/usr.bin/openssl/ec.c
+++ b/usr.bin/openssl/ec.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec.c,v 1.5 2015/09/11 14:30:23 bcook Exp $ */
+/* $OpenBSD: ec.c,v 1.6 2015/10/10 22:28:51 doug Exp $ */
 /*
  * Written by Nils Larsch for the OpenSSL project.
  */
@@ -277,6 +277,11 @@ ec_main(int argc, char **argv)
        BIO *in = NULL, *out = NULL;
        char *passin = NULL, *passout = NULL;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        memset(&ec_config, 0, sizeof(ec_config));
 
        ec_config.asn1_flag = OPENSSL_EC_NAMED_CURVE;

diff --git a/usr.bin/openssl/ecparam.c b/usr.bin/openssl/ecparam.c
index 6adac86..bd0c5b8 100644 (file)
--- a/usr.bin/openssl/ecparam.c
+++ b/usr.bin/openssl/ecparam.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ecparam.c,v 1.13 2015/09/11 14:30:23 bcook Exp $ */
+/* $OpenBSD: ecparam.c,v 1.14 2015/10/10 22:28:51 doug Exp $ */
 /*
  * Written by Nils Larsch for the OpenSSL project.
  */
@@ -259,6 +259,11 @@ ecparam_main(int argc, char **argv)
        BIO *in = NULL, *out = NULL;
        int i, ret = 1;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        memset(&ecparam_config, 0, sizeof(ecparam_config));
        ecparam_config.asn1_flag = OPENSSL_EC_NAMED_CURVE;
        ecparam_config.form = POINT_CONVERSION_UNCOMPRESSED;

diff --git a/usr.bin/openssl/enc.c b/usr.bin/openssl/enc.c
index 6eb804f..d710382 100644 (file)
--- a/usr.bin/openssl/enc.c
+++ b/usr.bin/openssl/enc.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: enc.c,v 1.7 2015/09/11 14:30:23 bcook Exp $ */
+/* $OpenBSD: enc.c,v 1.8 2015/10/10 22:28:51 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -338,6 +338,11 @@ enc_main(int argc, char **argv)
        char pname[PROG_NAME_SIZE + 1];
        int i;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        memset(&enc_config, 0, sizeof(enc_config));
        enc_config.enc = 1;
 

diff --git a/usr.bin/openssl/errstr.c b/usr.bin/openssl/errstr.c
index 9cf7bfb..7bd97d9 100644 (file)
--- a/usr.bin/openssl/errstr.c
+++ b/usr.bin/openssl/errstr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: errstr.c,v 1.4 2015/08/22 16:36:05 jsing Exp $ */
+/* $OpenBSD: errstr.c,v 1.5 2015/10/10 22:28:51 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -98,6 +98,11 @@ errstr_main(int argc, char **argv)
        char buf[256];
        int ret = 0;
 
+       if (single_execution) {
+               if (pledge("stdio rpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        memset(&errstr_config, 0, sizeof(errstr_config));
 
        if (options_parse(argc, argv, errstr_options, NULL, &argsused) != 0) {

diff --git a/usr.bin/openssl/gendh.c b/usr.bin/openssl/gendh.c
index 208906e..ceea237 100644 (file)
--- a/usr.bin/openssl/gendh.c
+++ b/usr.bin/openssl/gendh.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: gendh.c,v 1.5 2015/09/11 14:30:23 bcook Exp $ */
+/* $OpenBSD: gendh.c,v 1.6 2015/10/10 22:28:51 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -134,6 +134,11 @@ gendh_main(int argc, char **argv)
        BIO *out = NULL;
        char *strbits = NULL;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        BN_GENCB_set(&cb, dh_cb, bio_err);
 
        memset(&gendh_config, 0, sizeof(gendh_config));

diff --git a/usr.bin/openssl/gendsa.c b/usr.bin/openssl/gendsa.c
index ee2d6ba..002380a 100644 (file)
--- a/usr.bin/openssl/gendsa.c
+++ b/usr.bin/openssl/gendsa.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: gendsa.c,v 1.4 2015/09/11 14:30:23 bcook Exp $ */
+/* $OpenBSD: gendsa.c,v 1.5 2015/10/10 22:28:51 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -85,6 +85,11 @@ gendsa_main(int argc, char **argv)
        BIO *out = NULL, *in = NULL;
        const EVP_CIPHER *enc = NULL;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        argv++;
        argc--;
        for (;;) {

diff --git a/usr.bin/openssl/genpkey.c b/usr.bin/openssl/genpkey.c
index d76e2fe..4d11bc3 100644 (file)
--- a/usr.bin/openssl/genpkey.c
+++ b/usr.bin/openssl/genpkey.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: genpkey.c,v 1.5 2015/09/11 14:30:23 bcook Exp $ */
+/* $OpenBSD: genpkey.c,v 1.6 2015/10/10 22:28:51 doug Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2006
  */
@@ -86,6 +86,11 @@ genpkey_main(int argc, char **argv)
 
        int do_param = 0;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        outformat = FORMAT_PEM;
 
        args = argv + 1;

diff --git a/usr.bin/openssl/genrsa.c b/usr.bin/openssl/genrsa.c
index 9f78f0d..1ca8713 100644 (file)
--- a/usr.bin/openssl/genrsa.c
+++ b/usr.bin/openssl/genrsa.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: genrsa.c,v 1.5 2015/09/11 14:30:23 bcook Exp $ */
+/* $OpenBSD: genrsa.c,v 1.6 2015/10/10 22:28:51 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -100,6 +100,11 @@ genrsa_main(int argc, char **argv)
        BIGNUM *bn = BN_new();
        RSA *rsa = NULL;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        if (!bn)
                goto err;
 

diff --git a/usr.bin/openssl/nseq.c b/usr.bin/openssl/nseq.c
index b73f512..15df3ff 100644 (file)
--- a/usr.bin/openssl/nseq.c
+++ b/usr.bin/openssl/nseq.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: nseq.c,v 1.4 2015/08/22 16:36:05 jsing Exp $ */
+/* $OpenBSD: nseq.c,v 1.5 2015/10/10 22:28:51 doug Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -109,6 +109,11 @@ nseq_main(int argc, char **argv)
        NETSCAPE_CERT_SEQUENCE *seq = NULL;
        int i, ret = 1;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        memset(&nseq_config, 0, sizeof(nseq_config));
 
        if (options_parse(argc, argv, nseq_options, NULL, NULL) != 0) {

diff --git a/usr.bin/openssl/ocsp.c b/usr.bin/openssl/ocsp.c
index 3a6ac36..c3b1b16 100644 (file)
--- a/usr.bin/openssl/ocsp.c
+++ b/usr.bin/openssl/ocsp.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ocsp.c,v 1.5 2015/10/03 03:39:19 deraadt Exp $ */
+/* $OpenBSD: ocsp.c,v 1.6 2015/10/10 22:28:51 doug Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -146,6 +146,11 @@ ocsp_main(int argc, char **argv)
        const EVP_MD *cert_id_md = NULL;
        const char *errstr = NULL;
 
+       if (single_execution) {
+               if (pledge("stdio inet rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        args = argv + 1;
        reqnames = sk_OPENSSL_STRING_new_null();
        ids = sk_OCSP_CERTID_new_null();

diff --git a/usr.bin/openssl/openssl.c b/usr.bin/openssl/openssl.c
index 9db7e5b..e842d6c 100644 (file)
--- a/usr.bin/openssl/openssl.c
+++ b/usr.bin/openssl/openssl.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: openssl.c,v 1.16 2015/10/10 20:18:30 deraadt Exp $ */
+/* $OpenBSD: openssl.c,v 1.17 2015/10/10 22:28:51 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -137,6 +137,8 @@
 #define FUNC_TYPE_MD_ALG        5
 #define FUNC_TYPE_CIPHER_ALG    6
 
+int single_execution = 0;
+
 typedef struct {
         int type;
         const char *name;
@@ -499,6 +501,8 @@ main(int argc, char **argv)
        fp = lh_FUNCTION_retrieve(prog, &f);
        if (fp != NULL) {
                argv[0] = pname;
+
+               single_execution = 1;
                ret = fp->func(argc, argv);
                goto end;
        }
@@ -509,6 +513,8 @@ main(int argc, char **argv)
        if (argc != 1) {
                argc--;
                argv++;
+
+               single_execution = 1;
                ret = do_cmd(prog, argc, argv);
                if (ret < 0)
                        ret = 0;

diff --git a/usr.bin/openssl/passwd.c b/usr.bin/openssl/passwd.c
index b628564..58fc5ec 100644 (file)
--- a/usr.bin/openssl/passwd.c
+++ b/usr.bin/openssl/passwd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: passwd.c,v 1.4 2015/08/22 16:36:05 jsing Exp $ */
+/* $OpenBSD: passwd.c,v 1.5 2015/10/10 22:28:51 doug Exp $ */
 
 #if defined OPENSSL_NO_MD5
 #define NO_MD5CRYPT_1
@@ -145,6 +145,11 @@ passwd_main(int argc, char **argv)
        int argsused;
        int ret = 1;
 
+       if (single_execution) {
+               if (pledge("stdio rpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        memset(&passwd_config, 0, sizeof(passwd_config));
 
        if (options_parse(argc, argv, passwd_options, NULL, &argsused) != 0) {

diff --git a/usr.bin/openssl/pkcs12.c b/usr.bin/openssl/pkcs12.c
index eaa7bcc..f8d8cc6 100644 (file)
--- a/usr.bin/openssl/pkcs12.c
+++ b/usr.bin/openssl/pkcs12.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pkcs12.c,v 1.4 2015/09/11 14:30:23 bcook Exp $ */
+/* $OpenBSD: pkcs12.c,v 1.5 2015/10/10 22:28:51 doug Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
  */
@@ -124,6 +124,11 @@ pkcs12_main(int argc, char **argv)
        char *macalg = NULL;
        char *CApath = NULL, *CAfile = NULL;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        cert_pbe = NID_pbe_WithSHA1And40BitRC2_CBC;
 
        enc = EVP_des_ede3_cbc();

diff --git a/usr.bin/openssl/pkcs7.c b/usr.bin/openssl/pkcs7.c
index 717928d..c29a9c8 100644 (file)
--- a/usr.bin/openssl/pkcs7.c
+++ b/usr.bin/openssl/pkcs7.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pkcs7.c,v 1.6 2015/09/11 14:30:23 bcook Exp $ */
+/* $OpenBSD: pkcs7.c,v 1.7 2015/10/10 22:28:51 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -154,6 +154,11 @@ pkcs7_main(int argc, char **argv)
        int ret = 1;
        int i;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        memset(&pkcs7_config, 0, sizeof(pkcs7_config));
 
        pkcs7_config.informat = FORMAT_PEM;

diff --git a/usr.bin/openssl/pkcs8.c b/usr.bin/openssl/pkcs8.c
index b3ccd19..4ac2af0 100644 (file)
--- a/usr.bin/openssl/pkcs8.c
+++ b/usr.bin/openssl/pkcs8.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pkcs8.c,v 1.6 2015/09/11 14:30:23 bcook Exp $ */
+/* $OpenBSD: pkcs8.c,v 1.7 2015/10/10 22:28:51 doug Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999-2004.
  */
@@ -226,6 +226,11 @@ pkcs8_main(int argc, char **argv)
        char pass[50], *passin = NULL, *passout = NULL, *p8pass = NULL;
        int ret = 1;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        memset(&pkcs8_config, 0, sizeof(pkcs8_config));
 
        pkcs8_config.iter = PKCS12_DEFAULT_ITER;

diff --git a/usr.bin/openssl/pkey.c b/usr.bin/openssl/pkey.c
index 72c0318..d1ddf5a 100644 (file)
--- a/usr.bin/openssl/pkey.c
+++ b/usr.bin/openssl/pkey.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pkey.c,v 1.5 2015/09/11 14:30:23 bcook Exp $ */
+/* $OpenBSD: pkey.c,v 1.6 2015/10/10 22:28:51 doug Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2006
  */
@@ -79,6 +79,11 @@ pkey_main(int argc, char **argv)
        int badarg = 0;
        int ret = 1;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        informat = FORMAT_PEM;
        outformat = FORMAT_PEM;
 

diff --git a/usr.bin/openssl/pkeyparam.c b/usr.bin/openssl/pkeyparam.c
index 8f4d3a5..cb40fbb 100644 (file)
--- a/usr.bin/openssl/pkeyparam.c
+++ b/usr.bin/openssl/pkeyparam.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pkeyparam.c,v 1.7 2015/09/11 14:30:23 bcook Exp $ */
+/* $OpenBSD: pkeyparam.c,v 1.8 2015/10/10 22:28:51 doug Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2006
  */
@@ -118,6 +118,11 @@ pkeyparam_main(int argc, char **argv)
        EVP_PKEY *pkey = NULL;
        int ret = 1;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        memset(&pkeyparam_config, 0, sizeof(pkeyparam_config));
 
        if (options_parse(argc, argv, pkeyparam_options, NULL, NULL) != 0) {

diff --git a/usr.bin/openssl/pkeyutl.c b/usr.bin/openssl/pkeyutl.c
index 2caa61e..64d1f90 100644 (file)
--- a/usr.bin/openssl/pkeyutl.c
+++ b/usr.bin/openssl/pkeyutl.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pkeyutl.c,v 1.7 2015/09/11 14:30:23 bcook Exp $ */
+/* $OpenBSD: pkeyutl.c,v 1.8 2015/10/10 22:28:51 doug Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2006.
  */
@@ -100,6 +100,11 @@ pkeyutl_main(int argc, char **argv)
 
        int ret = 1, rv = -1;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        argc--;
        argv++;
 

diff --git a/usr.bin/openssl/prime.c b/usr.bin/openssl/prime.c
index 55fac45..13398b0 100644 (file)
--- a/usr.bin/openssl/prime.c
+++ b/usr.bin/openssl/prime.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: prime.c,v 1.8 2015/09/12 15:04:06 lteo Exp $ */
+/* $OpenBSD: prime.c,v 1.9 2015/10/10 22:28:51 doug Exp $ */
 /* ====================================================================
  * Copyright (c) 2004 The OpenSSL Project.  All rights reserved.
  *
@@ -118,6 +118,11 @@ prime_main(int argc, char **argv)
        char *s;
        int ret = 1;
 
+       if (single_execution) {
+               if (pledge("stdio rpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        memset(&prime_config, 0, sizeof(prime_config));
 
        /* Default iterations for Miller-Rabin probabilistic primality test. */

diff --git a/usr.bin/openssl/rand.c b/usr.bin/openssl/rand.c
index b0df4eb..2377c6e 100644 (file)
--- a/usr.bin/openssl/rand.c
+++ b/usr.bin/openssl/rand.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: rand.c,v 1.8 2015/09/11 14:30:23 bcook Exp $ */
+/* $OpenBSD: rand.c,v 1.9 2015/10/10 22:28:51 doug Exp $ */
 /* ====================================================================
  * Copyright (c) 1998-2001 The OpenSSL Project.  All rights reserved.
  *
@@ -109,6 +109,11 @@ rand_main(int argc, char **argv)
        int i, r;
        BIO *out = NULL;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        memset(&rand_config, 0, sizeof(rand_config));
 
        if (options_parse(argc, argv, rand_options, &num_bytes, NULL) != 0) {

diff --git a/usr.bin/openssl/req.c b/usr.bin/openssl/req.c
index c7256ae..032944b 100644 (file)
--- a/usr.bin/openssl/req.c
+++ b/usr.bin/openssl/req.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: req.c,v 1.9 2015/09/14 01:45:03 doug Exp $ */
+/* $OpenBSD: req.c,v 1.10 2015/10/10 22:28:51 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -176,6 +176,11 @@ req_main(int argc, char **argv)
        const EVP_MD *md_alg = NULL, *digest = NULL;
        unsigned long chtype = MBSTRING_ASC;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        req_conf = NULL;
        cipher = EVP_aes_256_cbc();
        digest = EVP_sha256();

diff --git a/usr.bin/openssl/rsa.c b/usr.bin/openssl/rsa.c
index 708332a..a573760 100644 (file)
--- a/usr.bin/openssl/rsa.c
+++ b/usr.bin/openssl/rsa.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: rsa.c,v 1.5 2015/09/11 14:30:23 bcook Exp $ */
+/* $OpenBSD: rsa.c,v 1.6 2015/10/10 22:28:51 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -268,6 +268,11 @@ rsa_main(int argc, char **argv)
        BIO *out = NULL;
        char *passin = NULL, *passout = NULL;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        memset(&rsa_config, 0, sizeof(rsa_config));
        rsa_config.pvk_encr = 2;
        rsa_config.informat = FORMAT_PEM;

diff --git a/usr.bin/openssl/rsautl.c b/usr.bin/openssl/rsautl.c
index 2e97932..92dceff 100644 (file)
--- a/usr.bin/openssl/rsautl.c
+++ b/usr.bin/openssl/rsautl.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: rsautl.c,v 1.7 2015/09/11 14:30:23 bcook Exp $ */
+/* $OpenBSD: rsautl.c,v 1.8 2015/10/10 22:28:51 doug Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -98,6 +98,11 @@ rsautl_main(int argc, char **argv)
 
        int ret = 1;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        argc--;
        argv++;
 

diff --git a/usr.bin/openssl/s_client.c b/usr.bin/openssl/s_client.c
index 6d250f1..63f3038 100644 (file)
--- a/usr.bin/openssl/s_client.c
+++ b/usr.bin/openssl/s_client.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s_client.c,v 1.20 2015/10/06 03:29:49 deraadt Exp $ */
+/* $OpenBSD: s_client.c,v 1.21 2015/10/10 22:28:51 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -364,6 +364,11 @@ s_client_main(int argc, char **argv)
        int enable_timeouts = 0;
        long socket_mtu = 0;
 
+       if (single_execution) {
+               if (pledge("stdio inet rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        meth = SSLv23_client_method();
 
        c_Pause = 0;

diff --git a/usr.bin/openssl/s_server.c b/usr.bin/openssl/s_server.c
index 11e9814..1985083 100644 (file)
--- a/usr.bin/openssl/s_server.c
+++ b/usr.bin/openssl/s_server.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s_server.c,v 1.19 2015/10/06 03:29:49 deraadt Exp $ */
+/* $OpenBSD: s_server.c,v 1.20 2015/10/10 22:28:51 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -603,6 +603,12 @@ s_server_main(int argc, char *argv[])
        tlsextnextprotoctx next_proto = { NULL, 0 };
        const char *alpn_in = NULL;
        tlsextalpnctx alpn_ctx = { NULL, 0 };
+
+       if (single_execution) {
+               if (pledge("stdio inet rpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        meth = SSLv23_server_method();
 
        local_argc = argc;

diff --git a/usr.bin/openssl/s_time.c b/usr.bin/openssl/s_time.c
index c102726..417ff81 100644 (file)
--- a/usr.bin/openssl/s_time.c
+++ b/usr.bin/openssl/s_time.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s_time.c,v 1.12 2015/09/11 14:43:57 lteo Exp $ */
+/* $OpenBSD: s_time.c,v 1.13 2015/10/10 22:28:51 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -258,6 +258,11 @@ s_time_main(int argc, char **argv)
        char buf[1024 * 8];
        int ver;
 
+       if (single_execution) {
+               if (pledge("stdio inet rpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        s_time_meth = SSLv23_client_method();
 
        verify_depth = 0;

diff --git a/usr.bin/openssl/sess_id.c b/usr.bin/openssl/sess_id.c
index d7f3339..7bf14ad 100644 (file)
--- a/usr.bin/openssl/sess_id.c
+++ b/usr.bin/openssl/sess_id.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sess_id.c,v 1.5 2015/08/19 18:25:31 deraadt Exp $ */
+/* $OpenBSD: sess_id.c,v 1.6 2015/10/10 22:28:51 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -158,6 +158,11 @@ sess_id_main(int argc, char **argv)
        int ret = 1, i;
        BIO *out = NULL;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        memset(&sess_id_config, 0, sizeof(sess_id_config));
 
        sess_id_config.informat = FORMAT_PEM;

diff --git a/usr.bin/openssl/smime.c b/usr.bin/openssl/smime.c
index d981335..fee7c71 100644 (file)
--- a/usr.bin/openssl/smime.c
+++ b/usr.bin/openssl/smime.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: smime.c,v 1.4 2015/09/11 14:30:23 bcook Exp $ */
+/* $OpenBSD: smime.c,v 1.5 2015/10/10 22:28:51 doug Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
  */
@@ -112,6 +112,11 @@ smime_main(int argc, char **argv)
 
        X509_VERIFY_PARAM *vpm = NULL;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        args = argv + 1;
        ret = 1;
 

diff --git a/usr.bin/openssl/speed.c b/usr.bin/openssl/speed.c
index 1657a43..cc555af 100644 (file)
--- a/usr.bin/openssl/speed.c
+++ b/usr.bin/openssl/speed.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: speed.c,v 1.16 2015/09/20 13:39:13 miod Exp $ */
+/* $OpenBSD: speed.c,v 1.17 2015/10/10 22:28:51 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -469,6 +469,11 @@ speed_main(int argc, char **argv)
        int multi = 0;
        const char *errstr = NULL;
 
+       if (single_execution) {
+               if (pledge("stdio proc", NULL) == -1)
+                       perror("pledge");
+       }
+
        usertime = -1;
 
        memset(results, 0, sizeof(results));

diff --git a/usr.bin/openssl/spkac.c b/usr.bin/openssl/spkac.c
index b635b5e..1c8b707 100644 (file)
--- a/usr.bin/openssl/spkac.c
+++ b/usr.bin/openssl/spkac.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: spkac.c,v 1.5 2015/09/11 14:30:23 bcook Exp $ */
+/* $OpenBSD: spkac.c,v 1.6 2015/10/10 22:28:51 doug Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999. Based on an original idea by Massimiliano Pala
  * (madwolf@openca.org).
@@ -181,6 +181,11 @@ spkac_main(int argc, char **argv)
        NETSCAPE_SPKI *spki = NULL;
        EVP_PKEY *pkey = NULL;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        memset(&spkac_config, 0, sizeof(spkac_config));
        spkac_config.spkac = "SPKAC";
        spkac_config.spksect = "default";

diff --git a/usr.bin/openssl/ts.c b/usr.bin/openssl/ts.c
index 93d258d..04ff60a 100644 (file)
--- a/usr.bin/openssl/ts.c
+++ b/usr.bin/openssl/ts.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ts.c,v 1.10 2015/09/21 13:13:06 bcook Exp $ */
+/* $OpenBSD: ts.c,v 1.11 2015/10/10 22:28:51 doug Exp $ */
 /* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL
  * project 2002.
  */
@@ -149,6 +149,11 @@ ts_main(int argc, char **argv)
        /* Output is ContentInfo instead of TimeStampResp. */
        int token_out = 0;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        for (argc--, argv++; argc > 0; argc--, argv++) {
                if (strcmp(*argv, "-config") == 0) {
                        if (argc-- < 1)

diff --git a/usr.bin/openssl/verify.c b/usr.bin/openssl/verify.c
index 62ca63f..4975ad5 100644 (file)
--- a/usr.bin/openssl/verify.c
+++ b/usr.bin/openssl/verify.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: verify.c,v 1.4 2015/09/11 14:30:23 bcook Exp $ */
+/* $OpenBSD: verify.c,v 1.5 2015/10/10 22:28:51 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -85,6 +85,11 @@ verify_main(int argc, char **argv)
        X509_LOOKUP *lookup = NULL;
        X509_VERIFY_PARAM *vpm = NULL;
 
+       if (single_execution) {
+               if (pledge("stdio rpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        cert_ctx = X509_STORE_new();
        if (cert_ctx == NULL)
                goto end;

diff --git a/usr.bin/openssl/version.c b/usr.bin/openssl/version.c
index f47369d..e096f89 100644 (file)
--- a/usr.bin/openssl/version.c
+++ b/usr.bin/openssl/version.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: version.c,v 1.6 2015/08/22 16:36:05 jsing Exp $ */
+/* $OpenBSD: version.c,v 1.7 2015/10/10 22:28:51 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -213,6 +213,11 @@ version_usage(void)
 int
 version_main(int argc, char **argv)
 {
+       if (single_execution) {
+               if (pledge("stdio", NULL) == -1)
+                       perror("pledge");
+       }
+
        memset(&version_config, 0, sizeof(version_config));
 
        if (options_parse(argc, argv, version_options, NULL, NULL) != 0) {

diff --git a/usr.bin/openssl/x509.c b/usr.bin/openssl/x509.c
index ec592c2..07c2878 100644 (file)
--- a/usr.bin/openssl/x509.c
+++ b/usr.bin/openssl/x509.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509.c,v 1.9 2015/10/01 06:31:21 jsing Exp $ */
+/* $OpenBSD: x509.c,v 1.10 2015/10/10 22:28:51 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -198,6 +198,11 @@ x509_main(int argc, char **argv)
        unsigned long nmflag = 0, certflag = 0;
        const char *errstr = NULL;
 
+       if (single_execution) {
+               if (pledge("stdio rpath wpath cpath", NULL) == -1)
+                       perror("pledge");
+       }
+
        reqfile = 0;
 
        STDout = BIO_new_fp(stdout, BIO_NOCLOSE);