OpenBSD: pledge(2) some network-facing checks (#2225)

OpenBSD's pledge(2) system call allows the current process to
self-restrict itself, being reduced to promised pledges. For example,
unless a process says it wants to write to files, it is not allowed to
do so any longer.

This change starts by calling pledge(2) in some network-facing checks,
removing the more dangerous privileges, such as executing other files.

My initial motivation came from check_icmp, being installed as a setuid
binary and (temporarily) running with root privileges. There, the
pledge(2) calls result in check_icmp to only being allowed to interact
with the network and to setuid(2) to the calling user later on.

Afterwards, I went through my most commonly used monitoring plugins
directly interacting with the network. Thus, I continued with
pledge(2)-ing check_curl - having a huge codebase and all -,
check_ntp_time, check_smtp, check_ssh, and check_tcp.

For most of those, the changes were quite similar: start with
network-friendly promises, parse the configuration, give up file access,
and proceed with the actual check.

1 files changed, 12 insertions, 0 deletions

diff --git a/plugins/check_tcp.c b/plugins/check_tcp.c
index 09806373..430f1218 100644
--- a/plugins/check_tcp.c
+++ b/plugins/check_tcp.c
@@ -89,6 +89,14 @@ const int DEFAULT_NNTPS_PORT = 563;
 const int DEFAULT_CLAMD_PORT = 3310;
 
 int main(int argc, char **argv) {
+#ifdef __OpenBSD__
+        /* - rpath is required to read --extra-opts (given up later)
+         * - inet is required for sockets
+         * - unix is required for Unix domain sockets
+         * - dns is required for name lookups */
+        pledge("stdio rpath inet unix dns", NULL);
+#endif // __OpenBSD__
+
         setlocale(LC_ALL, "");
         bindtextdomain(PACKAGE, LOCALEDIR);
         textdomain(PACKAGE);
@@ -216,6 +224,10 @@ int main(int argc, char **argv) {
                 usage4(_("Could not parse arguments"));
         }
 
+#ifdef __OpenBSD__
+        pledge("stdio inet unix dns", NULL);
+#endif // __OpenBSD__
+
         config = paw.config;
 
         if (verbosity > 0) {