From f1bfd0c518473ab439eff4d56441ce165d8bd0ca Mon Sep 17 00:00:00 2001
From: Klemens Nanni <kn@openbsd.org>
Date: Sat, 21 Oct 2023 09:54:48 +0300
Subject: [PATCH] Restrict systems operations on OpenBSD

Use pledge(2)[0] to limit jq(1) to reading files.
It does not change files and only writes to standard output/error.
It never deals with TTY, network, process management or other subsystems.

This is to reduce jq's attack surface and potential damage.

OpenBSD is carrying a local patch[1] in its official jq port/package
since 2016.  An improved version:

- drop no longer needed "getpw" promise
  f1c4947 "Avoid getpwuid for static linking" removed getpwuid(3) usage
- pledge before jq_init() to simplify the error path
- use perror(3) to print errno(2)

No behaviour change in tests or real world usage observed on
OpenBSD/amd64 7.4.

0: https://man.openbsd.org/pledge.2
1: https://cvsweb.openbsd.org/cgi-bin/cvsweb/ports/textproc/jq/patches/patch-main_c
---
 src/main.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/main.c b/src/main.c
index 226c926c..3e5e1a1f 100644
--- a/src/main.c
+++ b/src/main.c
@@ -324,6 +324,13 @@ int main(int argc, char* argv[]) {
   (void) setlocale(LC_ALL, "");
 #endif
 
+#ifdef __OpenBSD__
+  if (pledge("stdio rpath", NULL) == -1) {
+    perror("pledge");
+    exit(JQ_ERROR_SYSTEM);
+  }
+#endif
+
 #ifdef WIN32
   jv_tsd_dtoa_ctx_init();
   fflush(stdout);